tag
Dos
Windows Message Queuing (MSMQ) Queue Manager Heap-Based Buffer Overflow (CVE-2026-54992)
MSMQ's Queue Manager processes RStartReceive/RStartTransactionalReceive responses from the MS-MQRR RPC interface as a set of SectionBuffer structures, each carrying its own SectionSizeAlloc. When a remote-read response is split into multiple sections,…
XRING — XQUIC QPACK Ring Buffer Resize Underflow (Remote Unauthenticated DoS)
XRING is a remote, unauthenticated crash in XQUIC (Alibaba's QUIC/HTTP-3 library) triggered by fully spec-compliant QPACK dynamic-table encoder-stream instructions. A single incorrect variable in xqcringmemresize() (src/common/utils/ringmem/xqcringmem.c)…
Tenda AC9 `AdvSetMacMtuWan` Stack-Based Buffer Overflow (CVE-2025-29384)
CVE-2025-29384 is a critical stack-based buffer overflow in the Tenda AC9 router's web management interface, specifically in the handling of the wanMTU POST parameter sent to the /goform/AdvSetMacMtuWan endpoint. The root cause is a lack of bounds checking…
Windows HTTP.sys Header-Count-Triggered Kernel Memory Corruption / BSOD (CVE-2026-49160)
This PoC targets a memory-safety bug in the Windows HTTP.sys kernel driver's request header parsing path (HTTP!UlpParseNextRequest / HTTP!UlpHandleRequest). The included http2bomb.py script establishes a TLS/HTTP2 connection to a target IIS/HTTP.sys-backed…
VirtualBox DevVGA_VBVA Integer Overflow leading to Guest-Triggerable DoS (CVE-2026-35250)
VirtualBox's DevVGAVBVA.cpp dimension-validation check uses a logical OR where an AND is required, letting a malicious guest supply width=0x80000001, height=16 and pass the bounds check. The resulting pointer-data size calculation (cbPointerData) then…
Tenda HG7/HG9/HG10 Router Stack-Based Buffer Overflow — CVE-2026-11499
CVE-2026-11499 is a stack-based buffer overflow (CWE-121) in the web-management formDOMAINBLK handler of Tenda HG7/HG9/HG10 router firmware. The vulnerable code path copies the attacker-supplied blkDomain form parameter into a fixed-size stack buffer without…
strongSwan RADIUS Attribute-Iterator Pre-Auth Infinite Loop / Remote DoS (CVE-2026-35333)
strongSwan's attributeenumerate() in src/libradius/radiusmessage.c accepts RADIUS attributes whose length byte is smaller than sizeof(rattrt) (2 bytes). When length == 0, the remaining-data counter underflows to a huge value and the loop's decrement condition…
PJSIP / PJNATH ICE Session Stack Buffer Overflow via SDP ice-ufrag (CVE-2026-25994)
CVE-2026-25994 is a stack-based buffer overflow in PJNATH's ICE (Interactive Connectivity Establishment) session handling, specifically in pjicesesscreatechecklist() in pjnath/src/pjnath/icesession.c. When constructing the ICE username, the code copies the…
PgBouncer SASL Length Field Integer Overflow Crash — CVE-2026-6664
PgBouncer's mbufgetbytes() bounds check (lib/usual/mbuf.h) computes buf->readpos + len > buf->writepos using 32-bit unsigned arithmetic, which wraps around when a client supplies a very large length value in a SASLInitialResponse ('p') message, silently…
Perfmatters WordPress Plugin Arbitrary File Deletion (CVE-2026-4350)
CVE-2026-4350 is a path traversal vulnerability in the Perfmatters WordPress performance plugin that allows arbitrary file deletion. The plugin's perfmattersdelete AJAX action (reachable via wp-admin/admin-ajax.php) takes a delete parameter and passes it to a…
OpenBSD slaacd/rad Infinite Loop via Malformed ND Option (CVE-2026-41285)
slaacd and rad each contain their own userland parser for ICMPv6 Neighbor Discovery (ND) options, separate from the kernel's already-correct nd6options() validation. Their parsing loop computes optlen = ndoptlen 8 - 2, and when an attacker sends an ND option…
Notepad++ nativeLang.xml Format String Crash / Info Disclosure — CVE-2026-3008
Notepad++'s Find Results panel initializer (sub1400916C0) retrieves the localized find-result-hits string from nativeLang.xml and passes it directly as the format string argument to wsprintfW, with no accompanying variadic data arguments and no validation of…
Nginx QUIC/HTTP-3 DCID Length Heap Overflow Lab (CVE-2026-0211)
This repository is a university penetration-testing course project that models a hypothetical heap buffer overflow in Nginx's QUIC (HTTP/3) packet parser, where the Destination Connection ID (DCID) length field is not properly bounds-checked before being used…
Multer Orphaned Temporary File Disk-Exhaustion DoS — CVE-2026-3304
Multer versions before 2.1.0 can leave temporary uploaded files permanently on disk when a multipart request is malformed in a specific way while using an asynchronous fileFilter callback (e.g., one deferred via setImmediate). When a valid file part is…
MiniTool pwdrvio.sys Kernel Driver Buffer Overflow — Local DoS/BSOD (CVE-2026-36980)
MiniTool's pwdrvio.sys kernel driver contains a buffer overflow in its IOCTL handler. An unprivileged local attacker can send a crafted IOCTL request that corrupts kernel pool memory, triggering an immediate system crash (BSOD) — a local denial-of-service…
Django MultiPartParser Base64 Whitespace CPU Amplification DoS — CVE-2026-33033
Django's multipart form parser has a special path for file parts declared with Content-Transfer-Encoding: base64. When the stripped chunk length isn't a multiple of 4, the parser calls fieldstream.read(1) in a loop to pull additional bytes for alignment. If…
Casdoor Authenticated Path Traversal to Arbitrary File Write (CVE-2026-6815)
Casdoor's Local File System storage provider fails to properly sanitize the pathPrefix configuration and fullFilePath parameter during resource uploads. An authenticated administrator (or equivalent privileged user) can use directory traversal sequences to…
BIRD/BIRD2 BGP AS_PATH Mask Matching Stack Buffer Overflow (CVE-2026-49943)
This repository documents a stack-based buffer overflow in BIRD's BGP ASPATH mask matching code (aspathmatch() in nest/a-path.c). The function uses a fixed-size stack array of 2048 + 1 pmpos entries, but parsepath() expands ASPATH segments from a received BGP…
Netlogon CLDAP Stack Buffer Overflow (CVE-2026-41089)
This PoC targets CVE-2026-41089, a stack-based buffer overflow in the Windows Netlogon CLDAP handling path. A crafted UDP/389 CLDAP ping containing an oversized User value can overrun a stack buffer in the LSASS/Netlogon flow and crash the domain controller.…
Notepad++ <= 8.9.6 Multiple Vulnerabilities (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800)
This PoC set covers three Notepad++ vulnerabilities affecting versions up to 8.9.6. CVE-2026-48770 demonstrates an out-of-bounds read crash by sending malformed WMCOPYDATA data to a running Notepad++ process. CVE-2026-48778 and CVE-2026-48800 demonstrate…
Next.js RSC Server-Action DoS via Flight Deserialization (CVE-2026-23870)
CVE-2026-23870 is a pre-authentication Denial of Service against any Next.js deployment using the App Router. An attacker sends crafted HTTP POST requests to any App Router server function endpoint with a deeply-cyclic or wide fan-out React Flight protocol…
Next.js Image Optimization API OOM DoS (Self-Hosted) (CVE-2026-44577)
CVE-2026-44577 is a denial-of-service issue in Next.js Image Optimization on self-hosted deployments. In vulnerable builds, /next/image can fetch very large local assets into memory without an effective size cap and then perform expensive image…
Next.js Cache Components Connection Exhaustion DoS (CVE-2026-44579)
CVE-2026-44579 is a denial-of-service issue in Next.js Cache Components (PPR) request handling. Before the fix, a crafted client request could force the server into the next-resume flow and trigger expensive request-body processing and resume rendering work.…
LDAP Nightmare — Windows LDAP Client RCE/DoS (CVE-2024-49113)
LDAP Nightmare is a public PoC for CVE-2024-49113, a critical vulnerability in Windows LDAP client behavior that can be reached through Netlogon workflow interactions. The PoC starts a malicious LDAP service and triggers victim-side LDAP resolution via…