Tools

redsection/jspanda

client-side prototype pullution vulnerability scanner

inferiorak/cve-2025-55182-react2shell-async-scanner

Async RCE scanner for CVE-2025-55182 / CVE-2025-66478 — prototype-pollution → code execution via React Server Actions.

dwisiswant0/ppfuzz

A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀

kleiton0x00/ppmap

A scanner/exploitation tool written in GO, which leverages client-side Prototype Pollution to XSS by exploiting known gadgets.

effortlessdevsec/ninjasworkout

Deliberately vulnerable Node.js web application containing 19+ security bugs (XSS, SSRF, Prototype Pollution, RCE) for hands-on penetration testing…

moleft/react2shell-toolbox

GUI-based security testing toolkit for detecting and exploiting the React Server Actions prototype pollution vulnerability (CVE-2025-55182) with POC…

bitnesswise/jquery-prototype-pollution-fix

A fix for CVE-2019-11358 (prototype pollution in jquery)

jenderal92/cve-2025-55182-react2shell

CVE-2025-55182 Exploit Tool – Python 2.7 exploit for Next.js prototype pollution leading to RCE

fazilbaig1/cve-2020-28458

Affected versions of this package are vulnerable to Prototype Pollution.

mr-destroyer/cve-2025-55182

Exploit for CVE-2025-55182 enabling remote code execution via prototype pollution in Next.js React Server Components, with command execution and…

fazilbaig1/cve-2021-23383

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from…

renewablehacking/cve-2020-7598

Educational lab demonstrating CVE-2020-7598 prototype pollution in minimist with a vulnerable Node.js/Express app, exploit payload, and…

raka200juta/28458

Python exploit script for CVE-2020-28458, a prototype pollution vulnerability in DataTables. It sends crafted payloads to target URLs, supports proxy…

mr-redoo7/cve-2026-27739-poc

Python PoC exploiting CVE-2026-27739 in Angular SSR: header injection via prototype pollution and SSRF chaining to AWS IMDS/GCP metadata for…

klassiker/cve-2025-55182

CodeQL-based analysis of CVE-2025-55182 prototype pollution vulnerability in React Server Components, with exploit POC and static detection queries…

thegenetic/cve-2026-2964-lab

Educational lab demonstrating CVE-2026-2964, a prototype pollution vulnerability in web-audio-recorder-js leading to RCE. Includes vulnerable and…

uriyahav/tough-cookie-2.5.0-cve-2023-26136-fix

ecurity patch for CVE-2023-26136 in tough-cookie 2.5.0 - Prototype pollution vulnerability fix with backward compatibility