FediSecfeeds

https://www.cve.org/CVERecord?id=CVE-2025-66429

##

CVE-2025-66429
(8.8 HIGH)

EPSS: 0.07%

updated 2025-12-12T21:15:59.187000

1 posts

An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.

cR0w@infosec.exchange at 2025-12-11T20:41:06.000Z ##

Post-auth ../ in cPanel.

##

CVE-2025-14611
(0 None)

EPSS: 0.00%

updated 2025-12-12T21:15:53.107000

2 posts

Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with pre

offseq at 2025-12-13T02:34:39.465Z ##

🔎 HIGH severity: CVE-2025-14611 in Gladinet CentreStack & TrioFox (<16.12.10420.56791) — hardcoded AES weakens crypto & enables unauth LFI. Restrict public access, monitor for LFI attempts, prep for patch. https://radar.offseq.com/threat/cve-2025-14611-vulnerability-in-gladinet-centresta-e4cb3dcd #OffSeq #Vulnerability #InfoSec

##

cR0w@infosec.exchange at 2025-12-12T21:27:43.000Z ##

There's now a CVE for the EITW Gladinet / Triofox hardcoded key vuln from a few days ago.

https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability

https://www.cve.org/CVERecord?id=CVE-2025-14611

##

CVE-2025-14174
(8.8 HIGH)

EPSS: 0.00%

updated 2025-12-12T21:15:52.350000

8 posts

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

ruario@vivaldi.net at 2025-12-13T08:21:06.000Z ##

I see that Brendan Eich from Brave is out lying about @Vivaldi again. He claims that Brave was pretty much the first out with a fix for CVE-2025-14174 and that Vivaldi still has not released a fix.

AFAIK we were actually first because we released 7.7.3862.88 (Android) based on 142.0.7444.237 from the Extended Support Release branch at 13:00 UTC (and for Desktop [7.7.3851.61] one hour later) on the 10th of December, which includes a fix for CVE-2025-14174. However since that CVE was not being publicly discussed yet, it was not initially listed in the changelog.

I have updated the Desktop announcement to mention the CVE now. Here it is:

https://vivaldi.com/blog/desktop/minor-update-five-7-7/

Also FWIW my Masto bot which tracks various desktop browser updates announced us here:

https://social.vivaldi.net/@browserversiontracker/115695393613130159

That bot has a sibling that looks at Vivaldi only releases (all platforms), which caught the Android release:

https://social.vivaldi.net/@vivaldiversiontracker/115695161453809439

And here is when it detected the Brave annoucement, more than a day later:

https://social.vivaldi.net/@browserversiontracker/115702471419843978

##

Android@activitypub.awakari.com at 2025-12-10T11:48:31.000Z ## Minor update(3) for Vivaldi Android Browser 7.7 Today’s update delivers regression fixes and a minor Chromium bump, which includes a patch for CVE-2025-14174, an out‑of‑bounds memory access i...

#Android #Android #Updates

Origin | Interest | Match ##

ruario@vivaldi.net at 2025-12-13T08:21:06.000Z ##

I see that Brendan Eich from Brave is out lying about @Vivaldi again. He claims that Brave was pretty much the first out with a fix for CVE-2025-14174 and that Vivaldi still has not released a fix.

AFAIK we were actually first because we released 7.7.3862.88 (Android) based on 142.0.7444.237 from the Extended Support Release branch at 13:00 UTC (and for Desktop [7.7.3851.61] one hour later) on the 10th of December, which includes a fix for CVE-2025-14174. However since that CVE was not being publicly discussed yet, it was not initially listed in the changelog.

I have updated the Desktop announcement to mention the CVE now. Here it is:

https://vivaldi.com/blog/desktop/minor-update-five-7-7/

Also FWIW my Masto bot which tracks various desktop browser updates announced us here:

https://social.vivaldi.net/@browserversiontracker/115695393613130159

That bot has a sibling that looks at Vivaldi only releases (all platforms), which caught the Android release:

https://social.vivaldi.net/@vivaldiversiontracker/115695161453809439

And here is when it detected the Brave annoucement, more than a day later:

https://social.vivaldi.net/@browserversiontracker/115702471419843978

##

DarkWebInformer@infosec.exchange at 2025-12-12T23:39:33.000Z ##

🚨 Two more vulnerabilities have been added to the CISA KEV Catalog

CVE-2018-4063: Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type

CVSS: 8.8

CVE-2025-14174: Google Chromium Out of Bounds Memory Access

CVSS: 8.8

https://darkwebinformer.com/cisa-kev-catalog/

##

cisakevtracker@mastodon.social at 2025-12-12T21:00:54.000Z ##

CVE ID: CVE-2025-14174
Vendor: Google
Product: Chromium
Date Added: 2025-12-12
Notes: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.html ; https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security ; https://nvd.nist.gov/vuln/detail/CVE-2025-14174
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-14174

##

cR0w@infosec.exchange at 2025-12-12T19:55:35.000Z ##

Two EITW 0days patched in iOS Webkit. The advisory says the exploits were against pre-iOS 26 but they have patches for 26 as well. And some other ones to go with those.

https://support.apple.com/en-us/125884

Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.
Processing maliciously crafted web content may lead to memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-43529 was also issued in response to this report.

##

applsec@infosec.exchange at 2025-12-12T19:45:39.000Z ##

📣 EMERGENCY UPDATES 📣

Apple pushed additional updates for 2 zero-days that may have been actively exploited.

🐛 CVE-2025-14174 (WebKit) additional patches,
🐛 CVE-2025-43529 (WebKit) additional patches:
- Safari 26.2

#apple #cybersecurity #infosec #security #ios

##

updated 2025-12-12T20:15:41.747000

2 posts

Plesk 18.0 has Incorrect Access Control.

offseq at 2025-12-13T01:05:13.162Z ##

🔔 CRITICAL: Plesk 18.0 (CVE-2025-66430) suffers from incorrect access control, risking unauthorized admin actions. No exploit yet, but review roles, restrict access, and monitor logs ASAP. Patch pending. https://radar.offseq.com/threat/cve-2025-66430-na-91279388 #OffSeq #Plesk #Vuln #AccessControl

updated 2025-12-12T19:16:03.773000

3 posts

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may pr

1 repos

https://github.com/williavs/nextjs-security-update

beyondmachines1 at 2025-12-13T08:01:31.608Z ##

New React Server vulnerabilities reported, enable Denial-of-Service attacks and source code exposure

Three new vulnerabilities were discovered in React Server Components (versions 19.0.0-19.2.2) following the React2Shell patch: two high-severity denial-of-service flaws (CVE-2025-55184, CVE-2025-67779) that can hang servers via malicious HTTP requests, and one medium-severity source code exposure vulnerability (CVE-2025-55183) that could leak hardcoded secrets.

**If you're using React Server Components or frameworks like Next.js, plan an upgrade to limit DoS risks and source code leaks. Not urgent like the React2Shell flaw, but a wise choice - especially the DoS patch. You don't want someone repeatedly crashing your application.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/new-react-server-vulnerabilities-reported-enable-denial-of-service-attacks-and-source-code-exposure-7-q-0-p-e/gD2P6Ple2L

##

beyondmachines1@infosec.exchange at 2025-12-13T08:01:31.000Z ##

New React Server vulnerabilities reported, enable Denial-of-Service attacks and source code exposure

Three new vulnerabilities were discovered in React Server Components (versions 19.0.0-19.2.2) following the React2Shell patch: two high-severity denial-of-service flaws (CVE-2025-55184, CVE-2025-67779) that can hang servers via malicious HTTP requests, and one medium-severity source code exposure vulnerability (CVE-2025-55183) that could leak hardcoded secrets.

**If you're using React Server Components or frameworks like Next.js, plan an upgrade to limit DoS risks and source code leaks. Not urgent like the React2Shell flaw, but a wise choice - especially the DoS patch. You don't want someone repeatedly crashing your application.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/new-react-server-vulnerabilities-reported-enable-denial-of-service-attacks-and-source-code-exposure-7-q-0-p-e/gD2P6Ple2L

##

cR0w@infosec.exchange at 2025-12-12T14:23:47.000Z ##

Happy patch your React Server Components again Friday to all who celebrate. The patch for CVE-2025-55184 was incomplete and still leaves systems vulnerable to DoS.

https://www.facebook.com/security/advisories/cve-2025-67779

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

##

CVE-2018-4063
(8.8 HIGH)

EPSS: 0.18%

updated 2025-12-12T19:15:59.653000

2 posts

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.

DarkWebInformer@infosec.exchange at 2025-12-12T23:39:33.000Z ##

🚨 Two more vulnerabilities have been added to the CISA KEV Catalog

CVE-2018-4063: Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type

CVSS: 8.8

CVE-2025-14174: Google Chromium Out of Bounds Memory Access

CVSS: 8.8

https://darkwebinformer.com/cisa-kev-catalog/

##

cisakevtracker@mastodon.social at 2025-12-12T19:00:58.000Z ##

CVE ID: CVE-2018-4063
Vendor: Sierra Wireless
Product: AirLink ALEOS
Date Added: 2025-12-12
Notes: https://www.cisa.gov/news-events/ics-advisories/icsa-19-122-03 ; https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---swi-psa-2019-003 ; https://source.sierrawireless.com/resources/airlink/hardware_reference_docs/airlink_es450_eol ; https://nvd.nist.gov/vuln/detail/CVE-2018-4063
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2018-4063

##

CVE-2025-56109
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:31:38

1 posts

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_wireless in file /usr/lib/lua/luci/control/admin/wireless.lua.

cR0w@infosec.exchange at 2025-12-11T18:45:47.000Z ##

More Ruijie

##

CVE-2025-56106
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:31:38

1 posts

OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.

cR0w@infosec.exchange at 2025-12-11T18:45:47.000Z ##

More Ruijie

##

CVE-2025-56099
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:31:37

1 posts

OS Command Injection vulnerability in Ruijie RG-YST AP_3.0(1)B11P280YST250F allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.

cR0w@infosec.exchange at 2025-12-11T18:45:47.000Z ##

More Ruijie

##

CVE-2025-56108
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:31:37

1 posts

OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.

cR0w@infosec.exchange at 2025-12-11T18:45:47.000Z ##

More Ruijie

##

CVE-2025-56117
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:31:37

1 posts

OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.

cR0w@infosec.exchange at 2025-12-11T18:45:47.000Z ##

More Ruijie

##

CVE-2025-56089
(8.8 HIGH)

EPSS: 0.14%

updated 2025-12-12T18:31:37

1 posts

OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56098
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:31:37

1 posts

OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56107
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:31:36

1 posts

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the submit_wifi in file /usr/lib/lua/luci/controller/admin/common_quick_config.lua.

cR0w@infosec.exchange at 2025-12-11T18:45:47.000Z ##

More Ruijie

##

CVE-2025-56110
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:31:36

1 posts

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_deal_update in file /usr/lib/lua/luci/controller/api/rcmsAPI.lua.

cR0w@infosec.exchange at 2025-12-11T18:45:47.000Z ##

More Ruijie

##

CVE-2025-56101
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:31:36

1 posts

OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.

cR0w@infosec.exchange at 2025-12-11T18:45:47.000Z ##

More Ruijie

##

CVE-2025-56096
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:31:36

1 posts

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the restart_modules in file /usr/lib/lua/luci/controller/admin/common.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56097
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:31:36

1 posts

OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56093
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:31:36

1 posts

OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the setWisp in file /usr/lib/lua/luci/modules/wireless.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56092
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:31:36

1 posts

OS Command Injection vulnerability in Ruijie X30 PRO V1 X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56088
(8.8 HIGH)

EPSS: 0.14%

updated 2025-12-12T18:31:36

1 posts

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_service in file /usr/lib/lua/luci/controller/admin/service.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56095
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:31:36

1 posts

OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2023-29144
(3.3 LOW)

EPSS: 0.00%

updated 2025-12-12T18:30:41

1 posts

Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios. This allows a bypass of detection.

jos1264@social.skynetcloud.site at 2025-12-12T17:45:00.000Z ##

CVE-2023-29144 - Malwarebytes Linux Signature Validation Bypass https://cvefeed.io/vuln/detail/CVE-2023-29144

##

CVE-2025-56086
(8.8 HIGH)

EPSS: 0.14%

updated 2025-12-12T18:30:34

1 posts

OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56084
(8.8 HIGH)

EPSS: 0.14%

updated 2025-12-12T18:30:33

1 posts

OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56085
(8.8 HIGH)

EPSS: 0.14%

updated 2025-12-12T18:30:33

1 posts

OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56079
(8.8 HIGH)

EPSS: 0.14%

updated 2025-12-12T18:30:32

1 posts

OS Command Injection vulnerability in Ruijie RG-EW1300G EW1300G V1.00/V2.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-55184
(7.5 HIGH)

EPSS: 0.07%

updated 2025-12-12T18:18:29.827000

6 posts

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite l

https://github.com/BakhodiribnYashinibnMansur/CVE-2025-55184

8 repos

https://github.com/bountyyfi/lonkero

https://github.com/ejpir/CVE-2025-55184

https://github.com/williavs/nextjs-security-update

https://github.com/hans362/CVE-2025-55184-poc

https://github.com/abdozkaya/rsc-security-auditor

https://github.com/caohungphu/react2shell

https://github.com/StealthMoud/react-server-cve-lab

beyondmachines1 at 2025-12-13T08:01:31.608Z ##

New React Server vulnerabilities reported, enable Denial-of-Service attacks and source code exposure

Three new vulnerabilities were discovered in React Server Components (versions 19.0.0-19.2.2) following the React2Shell patch: two high-severity denial-of-service flaws (CVE-2025-55184, CVE-2025-67779) that can hang servers via malicious HTTP requests, and one medium-severity source code exposure vulnerability (CVE-2025-55183) that could leak hardcoded secrets.

**If you're using React Server Components or frameworks like Next.js, plan an upgrade to limit DoS risks and source code leaks. Not urgent like the React2Shell flaw, but a wise choice - especially the DoS patch. You don't want someone repeatedly crashing your application.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/new-react-server-vulnerabilities-reported-enable-denial-of-service-attacks-and-source-code-exposure-7-q-0-p-e/gD2P6Ple2L

##

beyondmachines1@infosec.exchange at 2025-12-13T08:01:31.000Z ##

New React Server vulnerabilities reported, enable Denial-of-Service attacks and source code exposure

Three new vulnerabilities were discovered in React Server Components (versions 19.0.0-19.2.2) following the React2Shell patch: two high-severity denial-of-service flaws (CVE-2025-55184, CVE-2025-67779) that can hang servers via malicious HTTP requests, and one medium-severity source code exposure vulnerability (CVE-2025-55183) that could leak hardcoded secrets.

**If you're using React Server Components or frameworks like Next.js, plan an upgrade to limit DoS risks and source code leaks. Not urgent like the React2Shell flaw, but a wise choice - especially the DoS patch. You don't want someone repeatedly crashing your application.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/new-react-server-vulnerabilities-reported-enable-denial-of-service-attacks-and-source-code-exposure-7-q-0-p-e/gD2P6Ple2L

##

cR0w@infosec.exchange at 2025-12-12T14:23:47.000Z ##

Happy patch your React Server Components again Friday to all who celebrate. The patch for CVE-2025-55184 was incomplete and still leaves systems vulnerable to DoS.

https://www.facebook.com/security/advisories/cve-2025-67779

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

##

cR0w@infosec.exchange at 2025-12-11T22:14:53.000Z ##

F5 finally confirmed their stuff is not impacted by CVE-2025-55184.

https://my.f5.com/manage/s/article/K000158154

##

jschauma@mstdn.social at 2025-12-11T21:29:25.000Z ##

If you just updated React / NextJS for #react2shell , you now get to update again. Two additional vulnerabilities identified in follow-up work were just published: CVE-2025-55183 (DoS), CVE-2025-55184 (Source Code Exposure)

https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

https://nextjs.org/blog/security-update-2025-12-11

##

jos1264@social.skynetcloud.site at 2025-12-11T21:00:03.000Z ##

CVE-2025-55184 - "React Server Components Denial of Service Vulnerability" https://cvefeed.io/vuln/detail/CVE-2025-55184

##

CVE-2025-55183
(5.3 MEDIUM)

EPSS: 0.06%

updated 2025-12-12T18:18:19.950000

4 posts

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Serve

7 repos

https://github.com/bountyyfi/lonkero

https://github.com/williavs/nextjs-security-update

https://github.com/kimtruth/CVE-2025-55183-poc

https://github.com/Saturate/CVE-2025-55183

https://github.com/X-Cotang/CVE-2025-55183_POC

https://github.com/StealthMoud/react-server-cve-lab

https://github.com/omaidnebari/RSC-Scanner-POC

beyondmachines1 at 2025-12-13T08:01:31.608Z ##

New React Server vulnerabilities reported, enable Denial-of-Service attacks and source code exposure

Three new vulnerabilities were discovered in React Server Components (versions 19.0.0-19.2.2) following the React2Shell patch: two high-severity denial-of-service flaws (CVE-2025-55184, CVE-2025-67779) that can hang servers via malicious HTTP requests, and one medium-severity source code exposure vulnerability (CVE-2025-55183) that could leak hardcoded secrets.

**If you're using React Server Components or frameworks like Next.js, plan an upgrade to limit DoS risks and source code leaks. Not urgent like the React2Shell flaw, but a wise choice - especially the DoS patch. You don't want someone repeatedly crashing your application.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/new-react-server-vulnerabilities-reported-enable-denial-of-service-attacks-and-source-code-exposure-7-q-0-p-e/gD2P6Ple2L

##

beyondmachines1@infosec.exchange at 2025-12-13T08:01:31.000Z ##

New React Server vulnerabilities reported, enable Denial-of-Service attacks and source code exposure

Three new vulnerabilities were discovered in React Server Components (versions 19.0.0-19.2.2) following the React2Shell patch: two high-severity denial-of-service flaws (CVE-2025-55184, CVE-2025-67779) that can hang servers via malicious HTTP requests, and one medium-severity source code exposure vulnerability (CVE-2025-55183) that could leak hardcoded secrets.

**If you're using React Server Components or frameworks like Next.js, plan an upgrade to limit DoS risks and source code leaks. Not urgent like the React2Shell flaw, but a wise choice - especially the DoS patch. You don't want someone repeatedly crashing your application.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/new-react-server-vulnerabilities-reported-enable-denial-of-service-attacks-and-source-code-exposure-7-q-0-p-e/gD2P6Ple2L

##

jschauma@mstdn.social at 2025-12-11T21:29:25.000Z ##

If you just updated React / NextJS for #react2shell , you now get to update again. Two additional vulnerabilities identified in follow-up work were just published: CVE-2025-55183 (DoS), CVE-2025-55184 (Source Code Exposure)

https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

https://nextjs.org/blog/security-update-2025-12-11

##

jos1264@social.skynetcloud.site at 2025-12-11T21:00:03.000Z ##

CVE-2025-55183 - Apache React Server Components Information Disclosure https://cvefeed.io/vuln/detail/CVE-2025-55183

##

CVE-2025-56120
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:15:44.537000

1 posts

OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.

cR0w@infosec.exchange at 2025-12-11T18:45:47.000Z ##

More Ruijie

##

CVE-2025-56118
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:15:44.377000

1 posts

OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.

cR0w@infosec.exchange at 2025-12-11T18:45:47.000Z ##

More Ruijie

##

CVE-2025-56114
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:15:44.047000

1 posts

OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.

cR0w@infosec.exchange at 2025-12-11T18:45:47.000Z ##

More Ruijie

##

CVE-2025-56113
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:15:43.890000

1 posts

OS Command Injection vulnerability in Ruijie RG-YST EST, YSTAP_3.0(1)B11P280YST250F V1.xxV2.xx allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.

cR0w@infosec.exchange at 2025-12-11T18:45:47.000Z ##

More Ruijie

##

CVE-2025-56111
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:15:43.730000

1 posts

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the network_set_wan_conf in file /usr/lib/lua/luci/controller/admin/netport.lua.

cR0w@infosec.exchange at 2025-12-11T18:45:47.000Z ##

More Ruijie

##

CVE-2025-56102
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:15:42.737000

1 posts

OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.

cR0w@infosec.exchange at 2025-12-11T18:45:47.000Z ##

More Ruijie

##

CVE-2025-56094
(8.8 HIGH)

EPSS: 0.11%

updated 2025-12-12T18:15:41.603000

1 posts

OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/host_access_delay.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56091
(8.8 HIGH)

EPSS: 0.14%

updated 2025-12-12T18:15:41.120000

1 posts

OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56090
(8.8 HIGH)

EPSS: 0.14%

updated 2025-12-12T18:15:40.960000

1 posts

OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56087
(8.8 HIGH)

EPSS: 0.14%

updated 2025-12-12T18:15:40.483000

1 posts

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the run_tcpdump in file /usr/lib/lua/luci/controller/admin/common_tcpdump.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56083
(8.8 HIGH)

EPSS: 0.14%

updated 2025-12-12T18:15:39.843000

1 posts

OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_networkId_merge.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56082
(8.8 HIGH)

EPSS: 0.14%

updated 2025-12-12T18:15:39.687000

1 posts

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the check_changes in file /usr/lib/lua/luci/controller/admin/common.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

##

CVE-2025-56077
(8.8 HIGH)

EPSS: 0.14%

updated 2025-12-12T18:15:39.370000

1 posts

OS Command Injection vulnerability in Ruijie RG-RAP2200(E) 247 2200 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.

cR0w@infosec.exchange at 2025-12-11T18:33:12.000Z ##

Ruijie

https://access.redhat.com/security/cve/CVE-2025-14512

2 posts

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.

_r_netsec@infosec.exchange at 2025-12-12T13:58:07.000Z ##

The FreePBX Rabbit Hole: CVE-2025-66039 & More https://horizon3.ai/attack-research/the-freepbx-rabbit-hole-cve-2025-66039-and-others/

updated 2025-12-12T15:18:13.390000

3 posts

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects on

beyondmachines1 at 2025-12-13T09:01:31.768Z ##

ConnectWise ScreenConnect patches critical code execution flaw

ConnectWise patched a critical vulnerability (CVE-2025-14265) in ScreenConnect remote maintenance software that allows authenticated attackers to execute arbitrary code by installing malicious extensions. All versions prior to 25.8 are affected; cloud servers were auto-updated while on-premises deployments require manual upgrade to version 25.8.

**Not urgent, but important. If you use on-premises ConnectWise ScreenConnect, plan an upgrade to version 25.8. The flaw is limited to users who are already admin, so it's not immediately exploitable. But an admin account can be compromised, so remind your admins of risks of infostealers and phishing.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/connectwise-screenconnect-patches-critical-code-execution-flaw-p-3-p-7-c/gD2P6Ple2L

##

beyondmachines1@infosec.exchange at 2025-12-13T09:01:31.000Z ##

ConnectWise ScreenConnect patches critical code execution flaw

updated 2025-12-12T15:18:13.390000

1 posts

updated 2025-12-12T15:18:13.390000

1 posts

A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.

cR0w@infosec.exchange at 2025-12-11T17:19:36.000Z ##

BoF in glib.

A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.

##

CVE-2025-14523
(8.2 HIGH)

EPSS: 0.03%

updated 2025-12-12T15:18:13.390000

2 posts

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style a

updated 2025-12-12T15:18:13.390000

1 posts

updated 2025-12-12T15:17:31.973000

1 posts

SolarEdge SE3680H has unauthenticated disclosure of sensitive information during the bootloader loop. While the device repeatedly initializes and waits for boot instructions, the bootloader emits diagnostic output this behavior can leak operating system information.

cR0w@infosec.exchange at 2025-12-12T16:58:13.000Z ##

Most of these SolarEdge vulns are local and unlikely to be a major issue ( assuming no supply chain / logistics compromise ) but they could be useful for people looking to hack on some of their own gear.

https://www.cve.org/CVERecord?id=CVE-2025-36743

https://www.cve.org/CVERecord?id=CVE-2025-36744

https://www.cve.org/CVERecord?id=CVE-2025-36745

https://www.cve.org/CVERecord?id=CVE-2025-36746

##

CVE-2025-36746
(0 None)

EPSS: 0.00%

updated 2025-12-12T15:17:31.973000

1 posts

SolarEdge monitoring platform contains a Cross‑Site Scripting (XSS) flaw that allows an authenticated user to inject payloads into report names, which may execute in a victim’s browser during a deletion attempt.

cR0w@infosec.exchange at 2025-12-12T16:58:13.000Z ##

updated 2025-12-11T22:02:22

3 posts

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

2 repos

https://github.com/Ashwesker/Blackash-CVE-2025-8110

https://github.com/rxerium/CVE-2025-8110

DarkWebInformer@infosec.exchange at 2025-12-11T20:21:12.000Z ##

🚨 CVE-2025-8110 (Zero-Day) Detection Template: Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code

GitHub: https://github.com/rxerium/CVE-2025-8110

Writeup: https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit

##

jbhall56@infosec.exchange at 2025-12-11T13:32:07.000Z ##

The flaw, tracked as CVE-2025-8110 (CVSS score: 8.7), is a case of file overwrite in the file update API of the Go-based self-hosted Git service. https://thehackernews.com/2025/12/unpatched-gogs-zero-day-exploited.html

##

beyondmachines1@infosec.exchange at 2025-12-11T10:01:31.000Z ##

Gogs Zero-Day vulnerability actively exploited

A zero-day vulnerability (CVE-2025-8110) in Gogs self-hosted Git service allows authenticated attackers to achieve remote code execution through a symlink bypass. Over 700 instances are reported as compromised since July 2025. Despite responsible disclosure in July and acknowledgment in October 2025, no patch is available as of December 10, 2025.

**If you're running Gogs (version 0.13.3 or earlier), this is urgent. Disable open registration in your settings and place the service behind a VPN or IP allow-list - there's an actively exploited vulnerability with no available patch. Check your server for suspicious repositories with random 8-character owner and repository names. These indicate your server is probably already compromised.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/gogs-zero-day-vulnerability-actively-exploited-l-k-t-s-8/gD2P6Ple2L

##

CVE-2025-58360
(8.2 HIGH)

EPSS: 73.17%

updated 2025-12-11T21:55:34

2 posts

## Description An XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint ``/geoserver/wms`` operation ``GetMap``. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. An XML External Entity attack is a type of attack that occurs when XML input contai

https://github.com/quyenheu/CVE-2025-58360

4 repos

https://github.com/Ashwesker/Blackash-CVE-2025-58360

https://github.com/Joker-Wiggin/CVE-2025-58360-GeoServer-XXE

https://github.com/rxerium/CVE-2025-58360

DarkWebInformer@infosec.exchange at 2025-12-11T23:31:14.000Z ##

🚨 CVE-2025-58360: OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability has been added to the CISA KEV Catalog

updated 2025-12-11T21:31:39

2 posts

A vulnerability was determined in UTT 进取 512W up to 3.1.7.7-171114. This impacts the function strcpy of the file /goform/formNatStaticMap of the component Endpoint. Executing manipulation of the argument NatBind can lead to buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did

jos1264@social.skynetcloud.site at 2025-12-11T20:10:03.000Z ##

CVE-2025-14534 - UTT 进取 512W Endpoint formNatStaticMap strcpy buffer overflow https://cvefeed.io/vuln/detail/CVE-2025-14534

##

updated 2025-12-11T18:30:53

2 posts

A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing manipulation of the argument page results in buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.

jos1264@social.skynetcloud.site at 2025-12-11T18:35:02.000Z ##

CVE-2025-14526 - Tenda CH22 L7Im frmL7ImForm buffer overflow https://cvefeed.io/vuln/detail/CVE-2025-14526

##

cR0w@infosec.exchange at 2025-12-11T17:30:20.000Z ##

Tenda

https://www.cve.org/CVERecord?id=CVE-2025-14526

##

CVE-2025-14528
(5.3 MEDIUM)

EPSS: 0.04%

updated 2025-12-11T18:30:53

1 posts

A vulnerability was detected in D-Link DIR-803 up to 1.04. Impacted is an unknown function of the file /getcfg.php of the component Configuration Handler. The manipulation of the argument AUTHORIZED_GROUP results in information disclosure. The attack may be performed from remote. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the

2 posts

### Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as content of HTML macros with insufficient escaping, and it is thus possible to close the HTML macro a

jos1264@social.skynetcloud.site at 2025-12-11T02:00:02.000Z ##

CVE-2025-66474 - XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection https://cvefeed.io/vuln/detail/CVE-2025-66474

##

jos1264@social.skynetcloud.site at 2025-12-11T00:15:02.000Z ##

CVE-2025-66474 - XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection https://cvefeed.io/vuln/detail/CVE-2025-66474

##

CVE-2025-66473(CVSS UNKNOWN)

EPSS: 0.04%

updated 2025-12-11T15:47:50

2 posts

### Impact XWiki's REST API doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration, this can lead to slowness and unavailability of the wiki. As an example, the `/rest/wikis/xwiki/spaces` resource returns all spaces on the wiki by default, which are basically all pages. #

updated 2025-12-11T06:30:32

2 posts

GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.

updated 2025-12-10T02:00:02.557000

10 posts

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

https://github.com/zack0x01/CVE-2025-55182-advanced-scanner-

100 repos

https://github.com/m3m0ryc0rrupt/CVE-2025-55182-PoC

https://github.com/freeqaz/react2shell

https://github.com/StealthMoud/CVE-2025-55182-Scanner

https://github.com/MedusaSH/POC-CVE-2025-55182

https://github.com/chitoz1300/React2Shell-CVE-2025-55182

https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc

https://github.com/jf0x3a/CVE-2025-55182-exploit

https://github.com/ejpir/CVE-2025-55182-bypass

https://github.com/Security-Phoenix-demo/react2shell-scanner-rce-react-next-CVE-2025-55182-CVE-2025-66478

https://github.com/techgaun/cve-2025-55182-scanner

https://github.com/Saturate/CVE-2025-55182-Scanner

https://github.com/fatguru/CVE-2025-55182-scanner

https://github.com/heiheishushu/rsc_detect_CVE-2025-55182

https://github.com/aliclub0x00/CVE-2025-55182-POC-NEXTJS

https://github.com/onlylovetx/CVE-2025-55182-CVE-2025-66478-Exploit-GUI

https://github.com/IrsyadSEC/CVE-2025-55182-MassPayloadAttack

https://github.com/CirqueiraDev/MassExploit-CVE-2025-55182

https://github.com/santihabib/CVE-2025-55182-analysis

https://github.com/CymulateResearch/React2Shell-Scanner

https://github.com/sickwell/CVE-2025-55182

https://github.com/cybertechajju/R2C-CVE-2025-55182-66478

https://github.com/f0xyx/CVE-2025-55182-Scanner

https://github.com/songsanggggg/CVE-2025-55182

https://github.com/SainiONHacks/CVE-2025-55182-Scanner

https://github.com/C00LN3T/React2Shell

https://github.com/yz9yt/React2Shell-CTF

https://github.com/anuththara2007-W/CVE-2025-55182-Exploit-extension

https://github.com/Ashwesker/Blackash-CVE-2025-55182

https://github.com/BankkRoll/Quickcheck-CVE-2025-55182-React-and-CVE-2025-66478-Next.js

https://github.com/xiaopeng-ye/react2shell-detector

https://github.com/LemonTeatw1/CVE-2025-55182-exploit

https://github.com/ihsansencan/React2Shell-CVE-2025-55182

https://github.com/7amzahard/React2shell

https://github.com/EynaExp/CVE-2025-55182-POC

https://github.com/assetnote/react2shell-scanner

https://github.com/theori-io/reactguard

https://github.com/Hghost0x00/CVE-2025-55182

https://github.com/cypholab/evilact

https://github.com/SoICT-BKSEC/CVE-2025-55182-docker-lab

https://github.com/BeichenDream/CVE-2025-55182-GodzillaMemoryShell

https://github.com/dwisiswant0/CVE-2025-55182

https://github.com/pax-k/react2shell-CVE-2025-55182-full-rce-script

https://github.com/kavienanj/CVE-2025-55182

https://github.com/kk12-30/CVE-2025-55182

https://github.com/zxz3650/CVE-2025-55182-POC

https://github.com/hualy13/CVE-2025-55182

https://github.com/GelukCrab/React-Server-Components-RCE

https://github.com/ynsmroztas/NextRce

https://github.com/Chocapikk/CVE-2025-55182

https://github.com/im-ezboy/CVE-2025-55182-zoomeye

https://github.com/yanoshercohen/React2Shell_CVE-2025-55182

https://github.com/pyroxenites/Nextjs_RCE_Exploit_Tool

https://github.com/xkillbit/cve-2025-55182-scanner

https://github.com/FurkanKAYAPINAR/ReactNext2Shell

https://github.com/AliHzSec/CVE-2025-55182

https://github.com/zzhorc/CVE-2025-55182

https://github.com/Spritualkb/CVE-2025-55182-exp

https://github.com/mrknow001/RSC_Detector

https://github.com/M4xSec/CVE-2025-55182-React2Shell-RCE-Shell

https://github.com/tobiasGuta/Next.js-RSC-RCE-Scanner-Burp-Suite-Extension

https://github.com/xcanwin/CVE-2025-55182-React-RCE

https://github.com/hackersatyamrastogi/react2shell-ultimate

https://github.com/Night-have-dreams/CVE-2025-55182-PoC

https://github.com/alsaut1/react2shell-lab

https://github.com/Syrins/CVE-2025-55182-React2Shell-RCE

https://github.com/msanft/CVE-2025-55182

https://github.com/whiteov3rflow/CVE-2025-55182-poc

https://github.com/sumanrox/rschunter

https://github.com/acheong08/CVE-2025-55182-poc

https://github.com/shamo0/react2shell-PoC

https://github.com/shyambhanushali/React2Shell

https://github.com/hoosin/CVE-2025-55182

https://github.com/RuoJi6/CVE-2025-55182-RCE-shell

https://github.com/VeilVulp/RscScan-cve-2025-55182

https://github.com/Archerkong/CVE-2025-55182

https://github.com/AdityaBhatt3010/React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web

https://github.com/andrei2308/react2shell

https://github.com/c0rydoras/CVE-2025-55182

https://github.com/ThemeHackers/CVE-2025-55182

https://github.com/ejpir/CVE-2025-55182-research

https://github.com/ayoub-intigriti/react2shell-cve

https://github.com/gensecaihq/react2shell-scanner

https://github.com/kOaDT/poc-cve-2025-55182

https://github.com/ZihxS/check-react-rce-cve-2025-55182

https://github.com/logesh-GIT001/CVE-2025-55182

https://github.com/keklick1337/CVE-2025-55182-golang-PoC

https://github.com/XiaomingX/CVE-2025-55182-poc

https://github.com/Cr4at0r/Next.js-RCE-Scanner-BurpSuite-Extension-

https://github.com/MrR0b0t19/CVE-2025-55182-shellinteractive

https://github.com/sudo-Yangziran/CVE-2025-55182POC

https://github.com/emredavut/CVE-2025-55182

https://github.com/l4rm4nd/CVE-2025-55182

https://github.com/horsenyet/RSC-Detect-CVE-2025-55182

https://github.com/nehkark/CVE-2025-55182

https://github.com/surajhacx/react2shellpoc

https://github.com/timsonner/React2Shell-CVE-2025-55182

https://github.com/zack0x01/vuln-app-CVE-2025-55182

https://github.com/gagaltotal/tot-react-rce-CVE-2025-55182

https://github.com/Pizz33/CVE-2025-55182-burpscanner

catc0n@infosec.exchange at 2025-12-12T18:29:22.000Z ##

VulnCheck analyzed several hundred #React2Shell CVE-2025-55182 exploits so you don't have to!

Amid all the slop (and there's so, so much slop) were some interesting finds that understandably escaped attention, including an early in-memory webshell variant, a PoC with logic that loads the Godzilla webshell, and a repo that deploys a lightweight WAF to block React2Shell payloads entirely (!)

@albinolobster wrote about exploit characteristics in aggregate and broke out the cooler examples here:

https://www.vulncheck.com/blog/react2shell-github

##

technadu@infosec.exchange at 2025-12-12T17:10:32.000Z ##

React2Shell exploitation now enables persistent access via EtherRAT’s blockchain-based C2.

https://www.technadu.com/react2shell-exploitation-evolves-into-persistent-access-threat/615626/

• Unauthenticated RCE via CVE-2025-55182
• EtherRAT instructions hidden inside Ethereum smart contracts
• Gov + cloud + critical-infrastructure orgs selectively targeted
• Unique per-host payloads hinder signature detection
• Monitor Node.js anomalies + Ethereum RPC activity

#React2Shell #CVE202555182 #EtherRAT #CyberSecurity #ThreatIntel #NextJS #AppSec

##

jos1264@social.skynetcloud.site at 2025-12-12T16:45:00.000Z ##

Critical React2Shell Vulnerability (CVE-2025-55182) Analysis: Surge in Attacks Targeting RSC-Enabled Services Worldwide https://cybersecuritynews.com/react2shell-cve-2025-55182-attacks-rsc-enabled-services/ #PressRelease

##

Kubernetes@activitypub.awakari.com at 2025-12-11T07:41:39.000Z ## React2Shell: Decoding CVE-2025-55182 – The Silent Threat in React Server Components On December 3, 2025, a critical remote code execution (RCE) vulnerability, dubbed “React2Shell,” was disclo...

#Product #and #Tech #Vulnerabilities #and #Threat #Research #CSAM #KCS #React2Shell #TotalAppSec

Origin | Interest | Match ##

AAKL@infosec.exchange at 2025-12-11T16:59:34.000Z ##

Cisco posted this yesterday, if you missed it:

Critical: CVE-2025-55182: Remote Code Execution Vulnerability in React and Next.js Frameworks: December 2025 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-react-flight-TYw32Ddb @TalosSecurity #infosec #vulnerability #React

##

Kubernetes@activitypub.awakari.com at 2025-12-11T07:41:39.000Z ## React2Shell: Decoding CVE-2025-55182 – The Silent Threat in React Server Components On December 3, 2025, a critical remote code execution (RCE) vulnerability, dubbed “React2Shell,” was disclo...

#Product #and #Tech #Vulnerabilities #and #Threat #Research #CSAM #KCS #React2Shell #TotalAppSec

Origin | Interest | Match ##

jbhall56@infosec.exchange at 2025-12-11T12:53:31.000Z ##

In addition to React, CVE-2025-55182 impacts other frameworks, including Next.js, Waku, React Router, and RedwoodSDK. https://www.securityweek.com/wide-range-of-malware-delivered-in-react2shell-attacks/

##

Kubernetes@activitypub.awakari.com at 2025-12-11T07:41:39.000Z ## React2Shell: Decoding CVE-2025-55182 – The Silent Threat in React Server Components On December 3, 2025, a critical remote code execution (RCE) vulnerability, dubbed “React2Shell,” was disclo...

#Product #and #Tech #Vulnerabilities #and #Threat #Research #CSAM #KCS #React2Shell #TotalAppSec

Origin | Interest | Match ##

oversecurity@mastodon.social at 2025-12-11T07:50:31.000Z ##

It didn’t take long: CVE-2025-55182 is now under active exploitation

Threat actors are now exploiting CVE-2025-55182, and attacks are poised to grow. Here's what you need to know about the vulnerability, how our...

🔗️ [Securelist] https://link.is.it/p03Ho5

##

_r_netsec@infosec.exchange at 2025-12-11T03:13:06.000Z ##

How widespread is the impact of Critical Security Vulnerability in React Server Components(CVE-2025-55182) https://helixguard.ai/blog/CVE-2025-55182

##

CVE-2025-54100
(7.8 HIGH)

EPSS: 0.17%

updated 2025-12-09T18:30:47

1 posts

Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.

2 repos

updated 2025-12-05T02:26:57

1 posts

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoi

2 repos

https://github.com/chasingimpact/CVE-2025-66516-Writeup-POC

https://github.com/Ashwesker/Blackash-CVE-2025-66516

GossiTheDog@cyberplace.social at 2025-12-12T12:25:22.000Z ##

On Apache Tika vulnerability CVE-2025-66516

- The fix was released in August.

- It's the same vulnerability as CVE-2025-54988 from August, they just issued a new CVE (which they probably shouldn't have) as they filed the scope wrong.

- It doesn't provide RCE. You can read local files with it as the Java user, e.g. /etc/passwd.

- Exploitation requires knowing a specific endpoint which processes PDFs to be vulnerable (so exploitation would be tailored).

It's not one to panic over.

##

CVE-2025-54988
(9.8 CRITICAL)

EPSS: 0.03%

updated 2025-11-05T20:40:58

1 posts

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a depende

1 repos

https://github.com/mgthuramoemyint/POC-CVE-2025-54988

GossiTheDog@cyberplace.social at 2025-12-12T12:25:22.000Z ##

On Apache Tika vulnerability CVE-2025-66516

- The fix was released in August.

- It's the same vulnerability as CVE-2025-54988 from August, they just issued a new CVE (which they probably shouldn't have) as they filed the scope wrong.

- It doesn't provide RCE. You can read local files with it as the Java user, e.g. /etc/passwd.

- Exploitation requires knowing a specific endpoint which processes PDFs to be vulnerable (so exploitation would be tailored).

It's not one to panic over.

##

CVE-2025-49144
(7.3 HIGH)

EPSS: 0.01%

updated 2025-10-23T14:15:35.980000

1 posts

Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicio

9 repos

https://github.com/0xCZR1/cve-2025-49144

https://github.com/onniio/CVE-2025-49144

https://github.com/Vr00mm/CVE-2025-49144

https://github.com/b0ySie7e/Notepad-8.8.1_CVE-2025-49144

https://github.com/timsonner/CVE-2025-49144-Research

https://github.com/ammarm0010/CVE-2025-49144_PoC

https://github.com/assad12341/notepad-v8.8.1-LPE-CVE-

https://github.com/TheTorjanCaptain/CVE-2025-49144_PoC

https://github.com/havertz2110/CVE-2025-49144

earthshine@masto.hackers.town at 2025-12-12T18:15:37.000Z ##

If you use PDQ, the Notepad++ 8.8.9 auto upgrade package is now available, but may require manual updates to your existing jobs to point to it. Patch that #0day if you haven't already. CVE-2025-49144

##

CVE-2025-49113
(9.9 CRITICAL)

EPSS: 88.03%

updated 2025-06-12T17:15:29.310000

1 posts

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.