Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
CVSS Skor
9.0
EPSS İhtimal
%2.1
Risk Skoru
0.2
Yayın
1 ay önce
Public Exploits · GitHub ve Metasploit Intelligence
Bu sekme NVD’nin exploit olarak etiketlediği kaynakları, CVE kimliğiyle eşleşen GitHub depolarını ve Rapid7 Metasploit Framework modüllerini tarar. Yalnızca bulunan gerçek kaynak bağlantıları gösterilir.
Research lab and exploit chain for CVE-2026-75604: path traversal in the Next.js incremental cache, to RCE on Windows.
A Python-based exploitation framework for CVE-2026-75604 that enables authorized penetration testers to validate Next.js Windows cache traversal vulnerabilities. Deploys reverse shells and webshells via path traversal, with built-in target verification and proxy support for seamless integration into standard pentest workflows.
CVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing
İlgili Benzer Açıklar
Deserialization of untrusted data in Meta React Server Dom Webpack
Deserialization of untrusted data in Facebook React
Vulnerability in Facebook React
Path traversal in Shopify React Router/node
Deserialization of untrusted data in Facebook React
@openhop/server: Path Traversal in Flow ID File Operations
Bu açığı API ile alın
Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2026-75604"