php-jpeg-injector

php-jpeg-injector Injects php payloads into jpeg images. Related to this post. Use Case You have a web application that runs a jpeg image through PHP's GD graphics library. Description This script injects PHP code into a specified jpeg image. The web application will execute the payload if it...

php-jpeg-injector

php-jpeg-injector 将php载荷注入jpeg图片中。相关帖子：this post 使用场景 你有一个通过PHP的GD图形库处理jpeg图片的web应用程序。 描述 此脚本将PHP代码注入到指定的jpeg图片中。如果web应用程序解释该图片，它将执行载荷。请确保输入的jpeg未被压缩！ 用法 python3 gd-jpeg.py JPEG PAYLOAD OUTPUTJPEG 例如：python3 gd-jpeg.py cat.jpeg '' infectedcat.jpeg 工作原理 PHP代码被注入到扫描头之后的无用/垃圾（棕色）空间中：...

CVE-2026-65650

CVE-2026-65650 — PoC: DoS autenticado en la subida de avatares de Elgg Denegación de servicio autenticada en la función de subida de avatares de Elgg mediante dimensiones de imagen sin límites, lo que provoca el agotamiento de la memoria de GD. Afectado: Elgg saveIconFromUploadedFile'avatar' retu...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2023-002407)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002407 advisory. In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont function in gd extension, it is possible to supply a specially crafted font file, such a...

php-exploit_cve-2022-31630

CVE-2022-31630 – Proof of Concept Exploit Warning: This code is made only for educational purposes and testing in an isolated laboratory environment. Use on other systems without permission is illegal and irresponsible. 📌 Description CVE-2022-31630 is an Out-of-Bounds OOB Read vulnerability in th...

CVE-2022-31630---Proof-of-Concept-Exploit-untuk-PHP-7.4.33

CVE-2022-31630 - Proof of Concept Exploit for PHP 7.4.33 Warning: This code is created solely for educational purposes and testing in an isolated laboratory environment. Use on other systems without authorization is illegal and irresponsible. 📋 Description CVE-2022-31630 is an Out-of-Bounds OOB...

Astra Linux – Vulnerability in libgd2

The readheadertga function in gdtga.c within the GD Graphics Library also known as LibGD in versions up to 2.3.2 allows remote attackers to cause a denial of service out-of-bounds read through a crafted TGA file...

EulerOS 2.0 SP12 : perl-GD (EulerOS-SA-2026-3367)

"According to the versions of the perl-GD package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open of filename arguments in makefilehandle...

EulerOS 2.0 SP12 : perl-GD (EulerOS-SA-2026-3292)

"According to the versions of the perl-GD package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open of filename arguments in makefilehandle...

Oracle Linux 7 : perl-GD (ELSA-2026-49758)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-49758 advisory. 2.49-3.0.1 - Security update for CVE-2026-11526 Orabug: 39825996 Tenable has extracted the preceding description block directly from the Oracle Linux security...

perl-GD security update

2.49-3.0.1 - Security update for CVE-2026-11526 Orabug: 39825996...

CVE-2026-78078: Unrestricted Upload of File with Dangerous Type

Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate 2.2.10 - Image uploads previously validated only file extension and basic size parameters. Non-image files disguised with raster extensions could be uploaded. Added strict MIME verification an...

ANT-2026-8RX9XHEB · php/php-src · Memory Corruption / Out-of-Bounds Write

oob-write high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-8RX9XHEB: Heap out-of-bounds write in font loader via stride...

GHSA-4X9G-VW65-VVF9 Grav: Unauthenticated denial of service via unbounded image derivative dimensions

Summary An unauthenticated visitor exhausts server memory and CPU by requesting an image with oversized resize dimensions. One request drives a worker to several gigabytes of RAM and tens of seconds of CPU. A few concurrent requests take the host down. Details Grav::fallbackUrl...

openSUSE 16 Security Update : gd (openSUSE-SU-2026:21548-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21548-1 advisory. This update for gd fixes the following issue: - CVE-2026-9672: security issue in libgd bsc1273101. Tenable has extracted the preceding description block...

SUSE SLED15 / SLES15 Security Update : gd (SUSE-SU-2026:3553-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3553-1 advisory. This update for gd fixes the following issue: - CVE-2026-9672: security issues in libgd bsc1273101. Tenable has extract...

OPENSUSE-SU-2026:21548-1 Security update for gd

This update for gd fixes the following issue: - CVE-2026-9672: security issue in libgd bsc1273101...

RHEL 8 : python-pillow (RHSA-2026:52551)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:52551 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

python-pillow: Pillow: Denial of Service via crafted GD 2.x image file

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile.open function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a...

python-pillow: Pillow: Denial of Service via crafted GD 2.x image file

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile.open function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a...