react2shell-poc

React2Shell - CVE-2025-55182 PoC Proof of Concept for CVE-2025-55182 , a critical unauthenticated Remote Code Execution vulnerability in React Server Components. CVSS Score: 10.0 Critical Vulnerability The vulnerability exists in React's Flight protocol deserializer. By exploiting prototype...

CVE-2025-55182-PoC

CVE-2025-55182-PoC Poc for CVE-2025-55182 Usage: python3 poc.py -u http://target.com --cmd "" Legal Disclaimer This tool is provided for educational purposes and authorized security testing only. Usage of this tool for attacking targets without prior mutual consent is illegal. The developer assum...

CVE-2026-75604

CVE-2026-75604 RCE PoC Python proof of concept for CVE-2026-75604, an unauthenticated remote command execution vulnerability in Windows-hosted Next.js applications that use both the Pages Router and App Router without Cache Components. Demonstration Requirements Next.js =13.4 =16.0 16.3.3 Native...

CVE-2025-66478

1 POST / HTTP/1.1 Host: localhost:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Next-Action: x X-Nextjs-Request-Id: b5dce965 Content-Type: multipart/form-data;...

Rust_CVE-2025-55182

CVE-2025-55182 Exploit Tool Rust Version Project Overview This project is a security research tool developed in Rust, targeting the Remote Code Execution RCE vulnerability present in [email protected]. The vulnerability allows an attacker to execute arbitrary code on a target server without...

CVE-2026-94482

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process...

EUVD-2026-108214

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process...

PT-2026-121419

Name of the Vulnerable Software and Affected Versions Next.js versions 13.0.0 through 15.5.27 Next.js versions 16.0.0 through 16.4.0 Description Crafted requests targeting App Router applications that implement at least one Server Action can cause excessive CPU consumption. This resource exhausti...

CVE-2026-91154

Missing Authentication for Critical Function CWE-306 in the product cache revalidation Server Action src/app/actions.ts, revalidateProducts in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cac...

CVE-2026-91154 Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service

Missing Authentication for Critical Function CWE-306 in the product cache revalidation Server Action src/app/actions.ts, revalidateProducts in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cac...

CVE-2026-91154 Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service

Missing Authentication for Critical Function CWE-306 in the product cache revalidation Server Action src/app/actions.ts, revalidateProducts in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cac...

EUVD-2026-88333

Missing Authentication for Critical Function CWE-306 in the product cache revalidation Server Action src/app/actions.ts, revalidateProducts in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cac...

CVE-2026-91154 Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service

Missing Authentication for Critical Function CWE-306 in the product cache revalidation Server Action src/app/actions.ts, revalidateProducts in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cac...

CVE-2026-91154

The MarcosCamara01 Ecommerce Template (before commit ec97209 ) is vulnerable to a Missing Authentication for Critical Function (CWE-306) within the revalidateProducts Server Action located in src/app/actions.ts. Because the file uses a "use server" scope without session or role checks, the revali...

CVE-2026-91154: Missing Authentication for Critical Function

Missing Authentication for Critical Function CWE-306 in the product cache revalidation Server Action src/app/actions.ts, revalidateProducts in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cac...

PT-2026-99922

Name of the Vulnerable Software and Affected Versions MarcosCamara01 Ecommerce Template versions prior to commit ec97209 Description Missing authentication in the product cache revalidation Server Action allows a remote, unauthenticated attacker to force the expiration of the entire storefront...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 - React2Shell CVE-2025-55182 unauthenticated...

CVE-2026-49455

Waku (a minimal React framework, npm package) prior to 1.0.0-beta.1 is vulnerable to cross-origin CSRF on its RSC server action dispatch. The root cause is the absence of any Origin or Sec-Fetch-Site validation in the RSC dispatch branch of request.ts, allowing a cross-origin attacker to invoke a...

CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...