Next.js CVE-2025-55182 – Automated Scanner (Python)

This repository contains a fully automated Python PoC scanner for CVE-2025-55182, a security vulnerability affecting Next.js 16.0.6. The tool allows security researchers and bug bounty hunters to test multiple targets at scale by simply providing a list of URLs.

---

🚀 Features

• 100% Python implementation
• Works specifically against Next.js 16.0.6 (CVE-2025-55182)
• Reads targets from urls.txt
• Sends automated exploit requests
• Displays full responses for each URL (useful for debugging & manual validation)
• Clean and simple code structure
• Includes a demo video walkthrough (remember to link it here)

---

📁 Project Structure

├── poc.py        # Main exploit scanner
├── urls.txt      # List of target URLs
└── README.md     # Documentation

---

📝 Requirements

• requests library
• requests_toolbelt library

---

📌 How It Works

1. Add all your target URLs (one per line) inside urls.txt.
2. Run the PoC script.
3. The script automatically attempts to trigger the vulnerability.
4. You get the raw response printed back with status + content.

The scanner is optimized for speed, automation, and clarity for bug bounty workflows.

---

▶️ Usage

python poc.py

Make sure that urls.txt is in the same directory. Example:

https://example1.com
https://example2.com
https://nextjs-target.com

---

📽️ Demo Video

A full demo video has been created showing:

• How the code works
• How to prepare your urls.txt
• How the script sends payloads
• Example vulnerable response

📽️ Demo Video

Click here to watch the demo

---

⚠️ Legal Disclaimer

This tool is for educational purposes and authorized testing only. Do NOT use it on systems you do not own or have explicit permission to test.

---

⭐ Contribute

Pull requests, improvements, and optimizations are welcome!

---

🐞 About the Author

Created by Kindone, a security researcher and bug bounty hunter focusing on advanced web vulnerabilities.