CVE-2007-2447_Samba_3.0.25rc3

CVE-2007-2447 'Username' map script' 命令执行 3.0.0 - 3.0.25rc3 3.0.20 - 3.0.25rc3 AMRIUNIX...

CVE-2026-22009-Linux-eBPF-Map-Locking-Race-Use-After-Free

CVE-2026-22009 – Linux eBPF Map 加锁竞态 → 释放后使用 程序代码（C 模拟） // ebpfmapuaf.c - Simulated concurrent map update/free include include include include void mapdata = NULL; int mapfreed = 0; void updatemapvoid arg // Simulate eBPF program updating map if !mapfreed char mapdata = 'A'; return NULL; void...

CVE-2018-20343

CVE-2018-20343 这是针对 CVE-2018-20343 的概念验证（PoC），该漏洞存在于 Ken Silverman 的 Build Engine 中。 生成的 .map 文件会触发缓冲区溢出并覆盖堆栈，如下所示： DosBox 0.74-2 下的 Open Watcom：分析者控制堆栈 FreeDos 1.2 下：分析者控制 EIP 漏洞代码位于 ENGINE.C 中： 1935 kreadfil,&numsectors,2; 1936 kreadfil,&sector0,sizeofsectortypenumsectors; 变量 sector 的声明大小为...

CVE-2026-98150

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A local user could trigger a Denial of Service DoS by providing an invalid processor identifier during per-CPU map operations on systems with non-contiguous CPU configurations. Due to improper validation of CPU flags, th...

CVE-2026-23111

🐧 CVE-2026-23111 - Linux内核nftables释放后使用漏洞 ⚠️ Linux内核nftables中的释放后使用 📖 概述 CVE-2026-23111 是一个影响Linux内核netfilter/nftables 子系统的高危释放后使用（UAF）漏洞。 该缺陷源于在nftables事务回滚操作期间错误处理了通配映射元素，导致内存安全问题，可能允许本地攻击者触发内核内存损坏。 🎯 漏洞信息 字段| 值 ---|--- CVE| CVE-2026-23111 严重性| 高 CVSS v3.1| 7.8 CWE| CWE-416 漏洞类型| 释放后使用 攻击向量| 本地...

CVE-2026-42533-Config-Scanner

nginx capture-clobber scanner A read-only static scanner that flags nginx configurations vulnerable to the complexvalue two-pass capture-clobbering bug class F5/nginx SIRT advisory, July 2026. It parses your config and reports the vulnerable pattern with the reason and location. It does not explo...

Nextjs_RCE_Exploit_Tool

Next.js RCE Exploit Tool CVE-2025-55182 !CAUTION 免责声明 / Disclaimer 本工具仅供安全研究与教学 使用。用户在使用本工具进行测试时，必须确保已获得目标系统的合法授权 。 严禁用于非授权的渗透测试、恶意攻击或任何非法用途。用户感知和利用漏洞所产生的一切风险与法律后果由用户自行承担 ，与本项目开发者无关。 如果不接受此条款，请立即停止下载或使用本工具。 本工具基于公开文章开发，不提供编译好的二进制发布版本，请自行审计代码并编译。 🙏 致谢 / Credits...

kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps

A flaw was found in the libceph component of the Linux kernel. A remote attacker could send a specially crafted monitor map monmap that advertises zero monitors. This malformed monmap is incorrectly processed as valid, which can lead to a client crash when attempting to open a session. This...

nginx-map-risk-audit

CVE-2026-42533：NGINX Map 正则表达式风险审查 关于 CVE-2026-42533 的防御性研究笔记，该漏洞是 NGINX 请求处理中的堆缓冲区溢出，与带有正则表达式捕获的 map 指令及某些变量求值模式有关。 用通俗的话说：NGINX 是 Web 服务器和反向代理软件。它通常位于网站和 API 前面，接收 Web 请求并决定将其发送到何处。map 规则是 NGINX 配置的一项功能，表示“如果这个请求值看起来像 X，就将这个变量设为 Y”。正则表达式捕获是从模式匹配中提取出的文本片段。 这个 CVE 之所以重要，是因为某些较旧的 NGINX 版本会错误地处理特定类...

CVE-2026-14431

CVE-2026-14431 Bug修复 https://chromium-review.googlesource.com/c/v8/v8/+/7950517 maglev Check map of inlined array in ArrayIteratorPrototypeNext Fixed: 523884658 Change-Id: I2a2bba817952d7023eb4b97ad41d8bb460fb9359 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7950517 Commit-Queu...

Samba-CVE-2007-2447-Exploit-Username-Map-Script

Samba CVE-2007-2447 利用工具 用户映射脚本 此仓库包含一个 Python 脚本，用于自动化利用 Samba 服务器（版本 3.0.20 至 3.0.25rc3）中的 CVE-2007-2447 漏洞。该工具仅用于 教育 目的和授权的渗透测试。 📝 技术学术描述 “用户映射脚本” 漏洞是由于当 Samba 配置中启用了 username map script 选项时，未对用户名输入进行清理所致。当发送包含 shell 元字符（如反引号 或子 shell $）的用户名时，服务器会以服务权限（通常是 root）执行这些命令。 🚀 要求 操作系统： Kali Linux /...

GPEWebDefender

GPEWebDefender A web-attack monitor. It sits next to nginx / Caddy / the app, tails access logs, and tells you when a site is being probed or exploited. If this process dies, the site keeps serving. It is not Wazuh, not OSSEC, and not a WAF. The command is gpewebdefender. Hosts, tokens, map pins,...

EUVD-2026-87829

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...

SUSE SLES16 Security Update : jsoup, re2j (SUSE-SU-2026:23867-1)

"The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:23867-1 advisory. This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited namespace map on every...

SUSE CVE-2026-98149

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix percpu map update indexing with sparse CPU IDs Per-CPU array, hash, and cgroup storage map updates without BPFFCPU or BPFFALLCPUS use a value buffer whose per-CPU slots are packed in possible-CPU order. The buffer is siz...

CVE-2026-98149

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix percpu map update indexing with sparse CPU IDs Per-CPU array, hash, and cgroup storage map updates without BPFFCPU or BPFFALLCPUS use a value buffer whose per-CPU slots are packed in possible-CPU order. The buffer is siz...

DEBIAN-CVE-2026-98149

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix percpu map update indexing with sparse CPU IDs Per-CPU array, hash, and cgroup storage map updates without BPFFCPU or BPFFALLCPUS use a value buffer whose per-CPU slots are packed in possible-CPU order. The buffer is siz...

CVE-2026-98065

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

AZL-104549 CVE-2026-98033 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve inner map identity in callback frames Callback frame constructors initialize map-typed argument registers with markregknownzero and then restore mapptr. This clears mapuid, which is the only field distinguishing inn...

DEBIAN-CVE-2026-98033

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve inner map identity in callback frames Callback frame constructors initialize map-typed argument registers with markregknownzero and then restore mapptr. This clears mapuid, which is the only field distinguishing inn...