katana

Katana A BootROM exploit for Qualcomm devices released within 2016 til 2019. Brief Explanation of the Exploit With the MSM8998 Nazgul SoC, the command 0x13 SAHARARESETSTATEMACHINEID was added. The command called into bootsaharaentry, which is supposed to reinitialize Sahara. The flaw is that each...

CVE-2025-5548

Technical study of vulnerability CVE-2025-5548 Introduction This work analyzes the vulnerability CVE-2025-5548 , associated with a stack buffer overflow in FreeFloat FTP Server v1.0. The main objective of the lab is to understand how a vulnerable application behaves when faced with manipulated...

CVE-2022-26937

Windows Network File System Crash PoC CVE-2022-26937 nt!KeBugCheckEx: fffff8038996efa0 48894c2408 mov qword ptr rsp+8,rcx ss:0018:ffffd000d589ae60=0000000000000139 1: kd !analyze -v Bugcheck Analysis KERNELSECURITYCHECKFAILURE 139 A kernel component has corrupted a critical data structure. The...

RTSPServer-Code-Execution-Vulnerability

Live Networks LIVE555 streaming media RTSPServer lookForHeader code execution vulnerability CVE-2018-4013 Summary An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library. A specially crafted packet can cause a stack-based buff...

bigint-buffer-safe

bigint-buffer-safe Safe, pure-JS drop-in replacement for bigint-buffer. Fixes CVE-2025-3194 CVSS 7.5, buffer overflow / DoS. Zero dependencies. No native bindings. Works in Node.js and browsers. Why does this exist? The original bigint-buffer package has a high-severity buffer overflow...

Learning-History-of-CFF-bug-in-iphone

Learning-History-of-CFF-bug-in-iphone Dive into CFF font and coincidently learn about a bof in cff parsing from some jailbreak. just for fun So.... wtf is CFF ? So from my knowledge it's a file format , but let's try to understad what wikipedia says:"CFF acts as a container to store multiple font...

CVE-2026-42533-Config-Scanner

nginx capture-clobber scanner A read-only static scanner that flags nginx configurations vulnerable to the complexvalue two-pass capture-clobbering bug class F5/nginx SIRT advisory, July 2026. It parses your config and reports the vulnerable pattern with the reason and location. It does not explo...

openbsd_ov1

OpenBSD TCP/IP overflow Tested with latest OpenBSD 7.2 Details: int ipdooptionsstruct mbuf m, struct ifnet ifp ... for ; cnt 0; cnt -= optlen, cp += optlen opt = cpIPOPTOPTVAL; if opt == IPOPTEOL break; if opt == IPOPTNOP optlen = 1; else if cnt cnt code = &cpIPOPTOLEN - uchar ip; goto bad; switc...

setcred

FreeBSD setcred2 — research artifacts This subdirectory collects the write-up and working exploits for the setcred2 stack buffer overflow in FreeBSD 14.x kernel. The vulnerability itself is fully documented in setcred.txt. The short version: kernsetcredcopyinsuppgroups uses sizeofgroups where...

ioctlance

IOCTLance Description Presented at CODE BLUE 2023, this project titled Enhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis introduces IOCTLance, a tool that enhances its capacity to detect various vulnerability types in Windows Driver Model WDM drivers. In a...

CVE-2026-62735

CVE-2026-62735 Information This vulnerability was originally discovered by Siyeon Wi. I reproduced the vulnerability independently for educational and case-study purposes. The vulnerability was also demonstrated at Pwn2Own Berlin 2026. References: TrendAI Zero Day Initiative status TrendAI Zero D...

CVE-2021-23017

CVE-2021-23017 PoC Scanner NGINX DNS Overflow Vulnerability Check - CVE-2021-23017 PoC This Python script checks if an nginx server is potentially vulnerable to the critical CVE-2021-23017 vulnerability, which affects the integrated DNS resolver in nginx and can cause a buffer overflow. 🔍 What do...

CVE-2026-42945

NGINX Rift RCE Proof of concept for CVE-2026-42945 , a critical heap buffer overflow in NGINX's ngxhttprewritemodule introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives. This vulnerability — along with three other memory...

CVE-2026-41089

CVE-2026-41089 — Windows Netlogon CLDAP Stack Buffer Overflow RCE Exploit CVE-ID: CVE-2026-41089 CVSS: 9.8 Critical CWE: CWE-121 Stack-based Buffer Overflow Attack Vector: UDP/389 CLDAP SearchRequest Impact: Remote Code Execution RCE / Denial of Service DoS Affected Versions: Windows Server 2012 ...

Elasticsearch-Exploit-CVE-2023-31419

Elasticsearch StackOverflow vulnerability A flaw was discovered in Elasticsearch, affecting the search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. Affected Versions: Elasticsearch versions from 7.0.0 to 7.17.12 and from 8.0.0 to...

jsonorg-fn1

json.org CVE-2022-45688 false negative The project illustrates CVE-2022-45688 in json.org -- there is a simple application XML2JSONConverter to read XML from input, convert it to JSON and pretty-print it to the console. Using malicious input, the application crashes with a stackoverflow. The test...

CVE-2026-54992-PoC

CVE-2026-54992 PoC Proof of concept for the Microsoft Message Queuing remote-read integer overflow tracked as CVE-2026-54992. The PoC uses two Windows VMs. A normal user on the vulnerable target asks the local MSMQ service to read from a queue hosted by the helper. The helper returns a malformed...

CVE-2008-4654

CVE-2008-4654 PoC exploit for vulnerability CVE-2008-4654 VLC Media Player Stack-Based Buffer Overflow via TiVo Ty file extension. Usage Run the script having a sample .ty+ file inside the same folder as the script. The ty+ file will be modified to execute the payload when opened with VLC Media...

CVE-2023-40296

CVE-2023-40296 async-sockets-cpp through 0.3.1 contains an off-by-one buffer overflow vulnerability in static void ReceiveFromUDPSocket udpSocket at udpsocket.hpp, around lines 160-167. The buffer overflow affects all corresponding UDP servers. The remote buffer overflow can be triggered by...

cve-2025-2082

How to Hack a Tesla? — Interactive Scenario Application This project is an interactive cybersecurity scenario based on a real vulnerability discovered by the security firm Synacktiv TPMS → VCSEC → CAN Bus chain. The scenario aims to teach how a Tesla Model 3 could be compromised through a...