https://poc.intelseclab.com/tags/dos/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-27_cve-2026-54992-windows-msmq-heap-overflow/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-27_cve-2026-54992-windows-msmq-heap-overflow/High severity (CVSS 8.4) — network · CVE-2026-54992. Status: PoC (crash/DoS confirmed, no RCE demonstrated). Affects: Windows Message Queuing (MSMQ) — Queue Manager (mqqm.dll, hosted in mqsvc.exe), reached via the MS-MQRR (RemoteRead) RPC interface. Tags: windows, msmq, message-queuing, heap-overflow, integer-overflow, rpc, dos, crash.networkHighwindowsmsmqmessage-queuingheap-overflowinteger-overflowrpcdoscrashhttps://poc.intelseclab.com/pocs/network/2026-07-08_xring-xquic-qpack-ring-mem-resize-underflow/Wed, 08 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-08_xring-xquic-qpack-ring-mem-resize-underflow/Critical severity — network. Status: Weaponized (public PoC, unpatched at publication). Affects: [alibaba/xquic](https://github.com/alibaba/xquic) — QUIC/HTTP-3 library, used by Tengine and reportedly across Alibaba's cloud/CDN infrastructure (Taobao, AliPay). Tags: quic, http3, qpack, xquic, alibaba, tengine, ring-buffer, integer-underflow, heap-oob-read, memcpy, remote, unauthenticated, dos, no-cve.networkCriticalquichttp3qpackxquicalibabatenginering-bufferinteger-underflowheap-oob-readmemcpyremoteunauthenticateddosno-cvehttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-29384-tenda-ac9-stack-overflow/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-29384-tenda-ac9-stack-overflow/Critical severity (CVSS 9.8) — network · CVE-2025-29384. Status: PoC. Affects: Tenda AC9 dual-band wireless router, web management interface (/goform/AdvSetMacMtuWan endpoint). Tags: tenda, ac9, router, stack-buffer-overflow, cwe-121, dos, rce, mips, embedded, iot, python, ruby, metasploit.networkCriticaltendaac9routerstack-buffer-overflowcwe-121dosrcemipsembeddediotpythonrubymetasploithttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49160-http-sys-http2-bomb-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49160-http-sys-http2-bomb-dos/High severity — binary · CVE-2026-49160. Status: PoC. Affects: Windows HTTP.sys kernel-mode driver (Windows 10 build 26100 confirmed in crash logs). Tags: windows, http.sys, kernel, http2, dos, bsod, memory-corruption, integer-overflow.binaryHighwindowshttp.syskernelhttp2dosbsodmemory-corruptioninteger-overflowhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-35250-virtualbox-vbva-integer-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-35250-virtualbox-vbva-integer-overflow/Low severity (CVSS 2.3) — binary · CVE-2026-35250. Status: PoC. Affects: Oracle VirtualBox — DevVGA_VBVA.cpp. Tags: virtualbox, integer-overflow, dos, vbva, guest-to-host, cwe-190, ai-assisted-research.binaryLowvirtualboxinteger-overflowdosvbvaguest-to-hostcwe-190ai-assisted-researchhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11499-tenda-router-bof/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11499-tenda-router-bof/High severity — network · CVE-2026-11499. Status: PoC. Affects: Tenda HG7 / HG9 / HG10 routers (firmware family HG7_HG9_HG10re_300001138_en_xpon and similar). Tags: tenda, router, buffer-overflow, cwe-121, dos, embedded, iot, rce.networkHightendarouterbuffer-overflowcwe-121dosembeddediotrcehttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-35333-strongswan-radius-infinite-loop-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-35333-strongswan-radius-infinite-loop-dos/Medium severity — network · CVE-2026-35333. Status: PoC. Affects: strongSwan — libradius. Tags: strongswan, radius, dos, infinite-loop, integer-underflow, pre-auth.networkMediumstrongswanradiusdosinfinite-loopinteger-underflowpre-authhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-25994-pjsip-ice-stack-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-25994-pjsip-ice-stack-overflow/High severity — network · CVE-2026-25994. Status: PoC. Affects: PJSIP / PJNATH (ICE implementation used by pjsua and SIP/VoIP stacks). Tags: pjsip, pjnath, ice, sip, voip, stack-overflow, dos, sdp, buffer-overflow.networkHighpjsippjnathicesipvoipstack-overflowdossdpbuffer-overflowhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-6664-pgbouncer-integer-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-6664-pgbouncer-integer-overflow/High severity — network · CVE-2026-6664. Status: PoC. Affects: PgBouncer (PostgreSQL connection pooler). Tags: pgbouncer, postgresql, integer-overflow, sasl, scram, dos, cwe-190.networkHighpgbouncerpostgresqlinteger-overflowsaslscramdoscwe-190https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4350-perfmatters-file-deletion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4350-perfmatters-file-deletion/High severity (CVSS 8.1) — web · CVE-2026-4350. Status: PoC. Affects: Perfmatters WordPress plugin. Tags: wordpress, plugin, perfmatters, path-traversal, arbitrary-file-deletion, admin-ajax, dos, nuclei.webHighwordpresspluginperfmatterspath-traversalarbitrary-file-deletionadmin-ajaxdosnucleihttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-41285-openbsd-slaacd-nd-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-41285-openbsd-slaacd-nd-dos/High severity — network · CVE-2026-41285. Status: Weaponized. Affects: OpenBSD slaacd (SLAAC autoconfiguration daemon) and rad (Router Advertisement daemon). Tags: openbsd, slaacd, rad, icmpv6, ipv6, dos, infinite-loop, scapy, neighbor-discovery.networkHighopenbsdslaacdradicmpv6ipv6dosinfinite-loopscapyneighbor-discoveryhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3008-notepadpp-formatstring/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3008-notepadpp-formatstring/Medium severity — binary · CVE-2026-3008. Status: PoC. Affects: Notepad++ 8.9.3. Tags: notepad++, format-string, wsprintfw, dos, information-disclosure, localization, windows.binaryMediumnotepad++format-stringwsprintfwdosinformation-disclosurelocalizationwindowshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0211-nginx-quic-heap-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0211-nginx-quic-heap-overflow/High severity — web · CVE-2026-0211 (repository explicitly labels this as a hypothetical/simulated CVE for coursework, not a confirmed vendor-assigned vulnerability). Status: PoC. Affects: A custom, deliberately vulnerabilized fork of Nginx 1.25.3's QUIC transport module (ngx_event_quic_transport.c), run inside a purpose-built Docker lab — not the stock upstream Nginx release. Tags: nginx, quic, http-3, heap-overflow, dos, fuzzing, dcid, academic-lab, docker.webHighnginxquichttp-3heap-overflowdosfuzzingdcidacademic-labdockerhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3304-multer-orphaned-file-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3304-multer-orphaned-file-dos/High severity (CVSS 8.7) — web · CVE-2026-3304. Status: PoC. Affects: Multer (Node.js multipart/form-data middleware for Express). Tags: multer, nodejs, express, dos, file-upload, orphaned-file, disk-exhaustion, multipart.webHighmulternodejsexpressdosfile-uploadorphaned-filedisk-exhaustionmultiparthttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-36980-minitool-kernel-driver-bsod-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-36980-minitool-kernel-driver-bsod-dos/Medium severity — binary · CVE-2026-36980. Status: PoC. Affects: MiniTool pwdrvio.sys kernel driver. Tags: minitool, kernel-driver, ioctl, bsod, dos, pool-corruption, windows.binaryMediumminitoolkernel-driverioctlbsoddospool-corruptionwindowshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33033-django-multipartparser-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33033-django-multipartparser-dos/Medium severity — web · CVE-2026-33033. Status: PoC. Affects: Django (django.http.multipartparser.MultiPartParser). Tags: django, dos, multipart, base64, cpu-amplification, python, file-upload.webMediumdjangodosmultipartbase64cpu-amplificationpythonfile-uploadhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6815-casdoor-path-traversal-file-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6815-casdoor-path-traversal-file-write/High severity — web · CVE-2026-6815. Status: Weaponized. Affects: Casdoor (open-source identity/access management platform). Tags: casdoor, path-traversal, arbitrary-file-write, rce, dos, authenticated, cwe-22.webHighcasdoorpath-traversalarbitrary-file-writercedosauthenticatedcwe-22https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-49943-bird-bgp-aspath-stack-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-49943-bird-bgp-aspath-stack-overflow/High severity (CVSS 3.1) — network · CVE-2026-49943. Status: PoC. Affects: BIRD Internet Routing Daemon (BGP implementation). Tags: bird, bird2, bgp, as-path, stack-buffer-overflow, denial-of-service, routing, dos.networkHighbirdbird2bgpas-pathstack-buffer-overflowdenial-of-serviceroutingdoshttps://poc.intelseclab.com/pocs/network/2026-06-04_netlogon-cldap-stack-buffer-overflow/Thu, 04 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-04_netlogon-cldap-stack-buffer-overflow/Critical severity (CVSS 9.8) — network · CVE-2026-41089. Status: Weaponized. Affects: Microsoft Windows Netlogon (Domain Controller CLDAP path). Tags: Netlogon, CLDAP, Windows Server, stack-overflow, unauthenticated, DoS, potential-RCE.networkCriticalNetlogonCLDAPWindows Serverstack-overflowunauthenticatedDoSpotential-RCEhttps://poc.intelseclab.com/pocs/binary/2026-05-28_notepad-plus-plus-8-9-6-multi-cve/Thu, 28 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-28_notepad-plus-plus-8-9-6-multi-cve/High severity (CVSS 5) — binary · CVE-2026-48770, CVE-2026-48778, CVE-2026-48800. Status: Patched. Affects: Notepad++. Tags: Notepad++, Windows, OOB-read, DoS, command-injection, config.xml, shortcuts.xml, local.binaryHighNotepad++WindowsOOB-readDoScommand-injectionconfig.xmlshortcuts.xmllocalhttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-rsc-dos-flight-deserialization/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-rsc-dos-flight-deserialization/High severity (CVSS 7.5) — web · CVE-2026-23870. Status: Weaponized. Affects: Next.js App Router (React server-action / RSC reply parser). Tags: DoS, RSC, React-Flight, deserialization, cyclic-payload, Next.js, App-Router, unauthenticated, pre-auth.webHighDoSRSCReact-Flightdeserializationcyclic-payloadNext.jsApp-Routerunauthenticatedpre-authhttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-image-optimization-api-oom-dos-self-hosted/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-image-optimization-api-oom-dos-self-hosted/Medium severity (CVSS 5.9) — web · CVE-2026-44577. Status: Weaponized. Affects: Next.js Image Optimization API (/_next/image) on self-hosted deployments. Tags: DoS, OOM, image-optimizer, Next.js, self-hosted, unauthenticated.webMediumDoSOOMimage-optimizerNext.jsself-hostedunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-cache-components-connection-exhaustion-dos/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-cache-components-connection-exhaustion-dos/High severity (CVSS 7.5) — web · CVE-2026-44579. Status: Weaponized. Affects: Next.js applications using Cache Components / Partial Prerendering (PPR). Tags: DoS, connection-exhaustion, next-resume, Next.js, cache-components, unauthenticated.webHighDoSconnection-exhaustionnext-resumeNext.jscache-componentsunauthenticatedhttps://poc.intelseclab.com/pocs/network/2026-05-15_ldap-nightmare-cve-2024-49113/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-15_ldap-nightmare-cve-2024-49113/Critical severity — network · CVE-2024-49113. Status: Weaponized. Affects: Microsoft Windows LDAP client / Netlogon interaction path. Tags: LDAP, NRPC, Windows Server, unauthenticated, DoS, potential-RCE.networkCriticalLDAPNRPCWindows ServerunauthenticatedDoSpotential-RCE