CVE-2019-11043

CVE-2019-11043 Beschreibung der Sicherheitslücke Bei Nginx führt die Verarbeitung von Anfragen mit %0a in fastcgisplitpathinfo dazu, dass PATHINFO aufgrund des Zeilenumbruchs \n leer wird. Und php-fpm weist bei der Verarbeitung von leerem PATHINFO einen logischen Fehler auf. Durch geschickte...

CVE-2026-55676

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

EUVD-2026-56948

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

Exploit for Out-of-bounds Write in Php

PoC exploit for CVE-2019-11043, an exploit for a bug in php-fpm. The exploit targets a vulnerability in certain nginx + php-fpm configurations, allowing a web user to execute code if the configuration is vulnerable. The exploit assumes that the nginx configuration has a location block that forwar...