CVE-2019-11043

CVE-2019-11043 Удаленное выполнение кода PHP-FPM Screencast: https://youtu.be/d6benC5FVZM Обзор Этот эксплойт нулевого дня в распространенных конфигурациях PHP-FPM был обнаружен во время конкурса Realworld CTF в 2019 году. Регулярное выражение используется для разбора запрошенного URI, но символы...

PHP-FPM-Remote-Code-Execution-Vulnerability-CVE-2019-11043-

CVE-2019-11043 1. Description de la vulnérabilité Sur Nginx, lors du traitement des requêtes contenant %0a, en raison du saut de ligne \n, PATHINFO devient vide via le split de fastcgipathinfo. PHP-FPM présente un défaut logique lorsque PATHINFO est vide. Un attaquant, par une construction...

CVE-2019-11043

PoC CVE-2019-11043 Une version Python de l'exploit CVE-2019-11043 https://github.com/neex/phuip-fpizdam Ce PoC est encore un brouillon, veuillez utiliser l'exploit écrit par @neex Analyse de la vulnérabilité : https://paper.seebug.org/1064/ Configuration du PoC Il suffit d'exécuter docker compose...

phuip-fpizdam

PHuiP-FPizdaM Qu'est-ce que c'est Ceci est un exploit pour un bogue dans php-fpm CVE-2019-11043. Dans certaines configurations nginx + php-fpm, il est possible de déclencher le bogue depuis l'extérieur. Cela signifie qu'un utilisateur web peut exécuter du code si vous avez une configuration...

[slackware-security] php

New php packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: extra/php82/php82-8.2.34-i586-1slack15.0.txz: Upgraded. This update fixes security issues: FPM: IPv6 ACL bypass in FastCGI listen.allowedclients due to...

EUVD-2026-82944

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...

CVE-2026-77929 ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...

CVE-2026-77929: Unrestricted Upload of File with Dangerous Type

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25, and 8.0.x below 8.0.12, when running PHP FPM SAPI with the main FPM daemon process running as the root user and child worker processes running as lower-privileged users, it is possible for the child processes to access memory...

Linux Distros Unpatched Vulnerability : CVE-2024-58382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service...

CVE-2024-58382

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2024-58382 league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2024-58382 league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

EUVD-2024-55755

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2024-58382

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2024-58382: Inefficient Algorithmic Complexity

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

EUVD-2026-72758

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to...

CVE-2026-73321 XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to...

CVE-2026-73321

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser . Authenticated attackers can submit a single post with deeply nested BBCode tags sufficient to exceed PHP's stack limit, causing fatal errors that repeatedly terminate PHP-FPM workers for all visitors ren...

CVE-2026-73321: Uncontrolled Recursion

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to...