curl: curl: Cookie injection via malicious HTTP server using super cookies

A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to...

rsc-security-auditor

🛡️ RSC Security Auditor Detect critical security vulnerabilities CVE-2025-66478, CVE-2025-55184 in your Next.js & React Server Components stack. 🚨 Urgent: Recent disclosures Dec 2025 have revealed critical DoS and RCE vulnerabilities in React Server Components. This tool helps you audit your...

CVE-2026-108859

A flaw was found in mcp-go. The HTTP server implementation does not restrict the size of incoming HTTP POST request bodies before buffering them into memory. A remote, unauthenticated attacker can exploit this vulnerability by sending excessively large or multiple concurrent requests, causing...

ore_react2shell_scanner

Rapticore Security Research - React2Shell Scanner A security assessment toolkit developed by the Rapticore Security Research Team for detecting React Server Components RSC vulnerabilities including CVE-2025-55182 React2Shell - a critical Remote Code Execution vulnerability. Overview This toolkit...

CVE-2025-55182-React2Shell-RCE

CVE-2025-55182 – React2Shell RCE GUI A modern, neon-themed GUI tool for security testing React2Shell CVE-2025-55182 on React Server Components / Next.js applications. Built with Python + CustomTkinter , it lets you: Check if a specific endpoint is vulnerable to React2Shell Run shell commands on...

CVE-2025-66478-Research-Proof-of-Concept

CVE-2025-66478-Research-Proof-of-Concept Overview This repository contains research and a proof-of-concept implementation related to CVE-2025-66478, a vulnerability affecting certain Next.js / React Server Components configurations. The project was developed in a controlled laboratory environment...

CVE-2017-5638

CVE-2017-5638 Table of Contents 1. Overview 2. Dependencies 3. Usage Overview This project is a prove-of-concept for the Apache Struts vulnerabilty. The goal was to create software that can generate and test random IPs for the vulnerabilty described above. Use this project on your own risk and fo...

Atlassian-Bitbucket-CVE-2022-36804

Atlassian-Bitbucket-Server-CVE-2022-36804 A critical command injection vulnerability was found in multiple API endpoints of the Atlassian Bit bucket Server and Data center. This vulnerability affects all versions of Bitbucket Server and Data Center released before versions &...

Info-Sys-Security-CVE-2025-55182

CVE-2025-55182 Security Lab "React2Shell" This repository contains a local academic lab for analyzing CVE-2025-55182 in a controlled React Server Components environment. The lab simulates the vulnerability, its exploitation, and the applied patch. 📁 Repository Layout Core Applications...

Blackash-CVE-2025-55182

🚨 CVE-2025-55182 — Critical React Server Vulnerability 🧠 What It Is ⚛️ A critical security flaw in React Server Components RSC 🧨 Caused by unsafe deserialization 🌐 Exploitable via network requests 🔓 No authentication required ☠️ Can lead to Remote Code Execution RCE ✅ This means attackers could...

cve-2025-32433

CVE-2025-32433 - Pre-Auth RCE in Erlang/OTP SSH Server Link to detailed write-up All considered vulnerable versions using Docker: Erlang/OTP-25.3.2 Erlang/OTP-26.2.5.11 Erlang/OTP-27.3.2 Link to exploit Links to files for mass scanning: Template for active scanning Template for passive scanning...

CVE-2026-44578-next-js-ssrf

CVE-2026-44578 — Next.js WebSocket Upgrade SSRF Lab Self-contained lab to reproduce the CVE-2026-44578 vulnerability CWE-918, SSRF in self-hosted Next.js applications that use the built-in Node.js server. Field| Value ---|--- CVE| CVE-2026-44578 GHSA| GHSA-c4j6-fc7j-m34r CVSS 3.1| 8.6 HIGH...

super-trouper

Super Trouper An MCP server for the Frida reverse engineering toolkit. Super Trouper runs an MCP server over STDIO that exposes Frida capabilities as tools for coding agents. It can connect to local, USB, and remote devices; inspect applications and processes; manage process sessions; and load,...

CVE-2026-107437

GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysis of the distributed binary and may also be exposed in process memory during runtime...

NachoVPN

NachoVPN 🌮🔒 NachoVPN is a Proof of Concept that demonstrates exploitation of SSL-VPN clients, using a rogue VPN server. It uses a plugin-based architecture so that support for additional SSL-VPN products can be contributed by the community. It currently supports various popular corporate VPN...

React2Shell-CVE-2025-55182

CVE-2025-55182 — React2Shell Unauthenticated RCE in React Server Components via insecure deserialization of the Flight protocol. A single HTTP request is enough to execute arbitrary code on the server — no credentials, no prior access needed. / / / /| |/ / \ / / / / / / / / // / / // / // | //...

EUVD-2026-97163

GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysis of the distributed binary and may also be exposed in process memory during runtime...

CVE-2026-107437

The GV-E-Map Server V18.2.0A contains a plaintext database password hard-coded within an application component. An attacker can recover these credentials by performing static analysis on the distributed binary or by accessing the process memory during runtime. This vulnerability leads to a high c...

CVE-2021-41773

Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution RCE Exploit Fixed Version Description This is an exploit for the Apache HTTP Server 2.4.49 vulnerability identified as CVE-2021-41773. The original version of the exploit published on Exploit-DB contained syntax and execution...

nosurf-cve-2025-46721

CVE-2025-46721: CSRF due to non-functional same-origin checks in justinas/nosurf What happened? Am I affected? PoC Patching Acknowledgements What happened? All versions of nosurf before 1.2.0 failed to apply same-origin checks for incoming requests. This happened due to relying on the .URL.Scheme...