Info-Sys-Security-CVE-2025-55182

CVE-2025-55182 Laboratorio di sicurezza "React2Shell" Questa repository contiene un laboratorio accademico locale per l'analisi di CVE-2025-55182 in un ambiente controllato di React Server Components. Il laboratorio simula la vulnerabilità, il suo sfruttamento e la patch applicata. 📁 Struttura...

Blackash-CVE-2025-55182

🚨 CVE-2025-55182 — Vulnerabilità Critica del Server React 🧠 Cos'è ⚛️ Una falla di sicurezza critica in React Server Components RSC 🧨 Causata da deserializzazione non sicura 🌐 Sfruttabile tramite richieste di rete 🔓 Nessuna autenticazione richiesta ☠️ Può portare a Esecuzione di codice remoto RCE ✅...

PoC-CVE-2025-55182

PoC: CVE-2026-33017 Una vulnerabilità di esecuzione remota di codice pre-autenticazione esiste nelle versioni 19.0.0, 19.1.0, 19.1.1 e 19.2.0 di React Server Components, inclusi i seguenti pacchetti: react-server-dom-parcel, react-server-dom-turbopack e react-server-dom-webpack. Il codice...

CVE-2026-59827

CVE-2026-59827: Desserialização insegura do Metabase em consultas nativas H2 Gravidade: Crítica CVSS 9.9 CVE: CVE-2026-59827 Aviso: GHSA-w95f-x9v9-wv36 Relator: Matheus Gutierre @Gutierre0x80 Publicado: 30 de junho de 2026 Resumo da vulnerabilidade Um usuário autenticado com acesso a consultas SQ...

CVE-2026-69098_exploit

CVE-2026-69098 — Kotaemon: Nicht authentifizierte Deserialisierungs-RCE Nicht authentifizierte Remote-Codeausführung in kotaemon = 0.12.0 über unsichere Deserialisierung im LLM-Einstellungs-Verbindungstest. Der Fehler Der Gradio-Handler checkconnection der LLM-Einstellungen von kotaemon...

CVE-2025-55182

CVE-2025-55182 Next.js RCE Reproduktionsanleitung Haftungsausschluss ⚠️ Dieses Tool ist nur für Sicherheitsforschung und Lehrzwecke bestimmt. Nicht für illegale Zwecke verwenden. ⚠️ Einführung in die Schwachstelle CVE-2025-55182 ist eine schwerwiegende Remote Code Execution RCE-Schwachstelle im...

CVE-2025-55182

CVE-2025-55182: React2Shell - Toolkit für Remote-Codeausführung in Next.js !WARNING Dieses Werkzeug wird nur für autorisierte Tests und Bildungszwecke bereitgestellt. Unautorisierter Netzwerkzugriff und Datenextraktion sind illegal. Die Benutzer sind dafür verantwortlich, dass sie vor der Nutzung...

CVE-2025-55182-React2Shell-CVSS-10.0-

البرنامج المتأثر: React Server Components الإصدارات 19.0.0, 19.1.0, 19.1.1, 19.2.0 نوع الثغرة: تنفيذ التعليمات البرمجية عن بُعد دون مصادقة عبر إلغاء التسلسل غير الآمن. الوصف: خلل في بروتوكول React Server Flight يسمح للمهاجمين غير المصادق عليهم بإرسال حمولات متسلسلة مصممة خصيصًا تستغل تلوث النموذج...

CVE-2026-59285

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4...

CVE-2026-10036

SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recoverifpossible. Attackers can...

CVE-2026-10036

SpeechBrain versions before 1.1.1 contain an arbitrary code execution vulnerability in its checkpoint recovery mechanism. The root cause is the use of PyYAML's unsafe loader when parsing CKPT.yaml metadata files during candidate enumeration in Checkpointer.recover_if_possible(). An attacker who c...

CVE-2026-10036 SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing

SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recoverifpossible. Attackers can...

cve-2025-55182-react2shell-analysis

CVE-2025-55182 React2Shell — Analyse de sécurité Aperçu Ce projet est une analyse technique de CVE-2025-55182, une vulnérabilité critique d'exécution de code à distance RCE divulguée en décembre 2025. La vulnérabilité affecte les composants serveur React et permet aux attaquants d'exécuter du cod...

CVE-2026-59285

Spring for GraphQL (versions 2.0.0–2.0.4 ) is vulnerable to Unsafe Deserialization (CWE-502) when processing paginated GraphQL queries. The root cause lies in the deserialization of untrusted data via Jackson 2.x when handling a Connection (pagination) field . An attacker can execute arbitrary co...

EUVD-2026-67174

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4...

CVE-2026-33439-OpenAM

CVE-2026-33439 ist ein unsicheres Deserialisierungsproblem vor der Authentifizierung in OpenAM 16.0.6, das JATO-ViewBean-Endpunkte betrifft. Öffentliche Sicherheitshinweise erwähnen JATO-Endpunkte, listen jedoch keine erreichbaren Routen auf. Diese Forschung identifiziert...

CVE-2026-33701-Unsafe-Deserialization-in-OpenTelemetry-Java-Agent-RMI-Instrumentation

CVE-2026-33701 — Deserializzazione non sicura nell'instrumentazione RMI dell'OpenTelemetry Java Agent Gravità: Critica CVSS v4.0: 9.3 Versioni interessate: opentelemetry-javaagent 2.26.1 Corretta in: 2.26.1 rilasciata il 23 marzo 2026 Panoramica OpenTelemetry è probabilmente il framework di...

Breaking-the-Update-Chain-Inside-CVE-2025-59287-and-the-WSUS-RCE-Threat

Quebrando a Cadeia de Atualizações: Dentro do CVE-2025-59287 e a Ameaça de RCE no WSUS O CVE-2025-59287 é uma vulnerabilidade crítica de RCE no Windows Server Update Services WSUS causada pela desserialização insegura de dados não confiáveis. Ela permite que atacantes remotos executem código...

CVE-2026-47878

Spring Batch's DefaultExecutionContextSerializer , used by default in the JDBC job repository, deserializes Base64-decoded bytes via ObjectInputStream.readObject() without an ObjectInputFilter class allowlist, enabling unsafe Java deserialization . Affected versions are Spring Batch 6.0.0–6.0.4 a...

CVE-2026-47878 Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier...