encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2016-3141

CVE-2016-3141 1. Vulnerability Detail. Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service memory corruption and application crash or possibly have unspecified other impact by triggering a...

expat_2_1_0_CVE-2024-28757

Expat, Release 2.1.0 This is Expat, a C library for parsing XML, written by James Clark. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in the...

libxml2-exploit

libxml2-exploit An example exploit for CVE-2017-7376 Install Download this repo and a vulnerable version of libxml2, e.g. v2.7.7: root@kitploit: git clone https://github.com/brahmstaedt/libxml2-exploit.git cd libxml2-exploit wget https://github.com/GNOME/libxml2/archive/v2.7.7.zip unzip v2.7.7.zi...

ruby-nmap

ruby-nmap Source Issues Documentation Description A Ruby API to nmap, the exploration tool and security / port scanner. Allows automating nmap and parsing nmap XML files. Features Provides a Ruby API for automating nmap. Provides a Parser for enumerating nmap XML scan files. Supports the full Nma...

CVE-2026-20224---XXE-Injection-en-Cisco-Catalyst-SD-WAN-Manager

CVE-2026-20224 - Cisco Catalyst SD-WAN Manager XXE Injection ⚠️ DISCLAIMER ESTA HERRAMIENTA ES EXCLUSIVAMENTE PARA FINES EDUCATIVOS Y DE INVESTIGACIÓN Este exploit está destinado exclusivamente para operaciones de equipo rojo autorizadas, pruebas de penetración e investigación de seguridad en...

CVE-2026-83615

A flaw was found in xmldom, a JavaScript library for parsing XML documents. A remote attacker could exploit this vulnerability by providing a specially crafted XML document. When processed, this document would cause the library to consume an excessive amount of memory, leading to the application...

CVE-2026-83613

A flaw was found in xmldom, a JavaScript module for parsing XML Extensible Markup Language documents. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing an element with numerous distinct attributes. The way xmldom processes these attributes...

CVE-2026-83607

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. This vulnerability allows a remote attacker to inject malicious content, such as attributes or elements, into serialized XML or HTML documents. This occurs because the Document.createElement function does not properl...

CVE-2026-83615

xmldom , a pure JavaScript XML DOM parser, has a quadratic memory consumption flaw in appendElement within lib/sax.js. The function clones the entire namespace map (currentNSMap) via _copy for every nested element that declares a new namespace prefix, keeping all ancestor maps alive on the parse ...

CVE-2026-83611 xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString can silently accept an end tag such as , close the element, and discard th...

CVE-2026-83606 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char? data group repeatedly repartition a long whitespace tail when...

x-stream__xstream_CVE-2020-26217_1-4-14-java77

master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. MXParser is recommend for use as it will greatly improve the...

overkill

Overkill Overkill is an exploit for a patched vulnerability affecting QNAP QTS. Due to the way QNAP discloses vulnerabilities, I'm unsure if this issue has a CVE or not. However, it was likely patched in November 2020 and April 2021. The n-day was "discovered" while doing diff analysis for...

CVE-2021-29447-PoC

CVE-2021-29447 Prueba de Concepto root@kitploit: ╔═╗╦ ╦╔═╗ ║ ╚╗╔╝║╣────2021-29447 ╚═╝ ╚╝ ╚═╝ Escrito por Isa Ebrahim - 0xRar en enero de 2023 ═══════════════════════════════════════════════════════════════════════════ Título: Problema de análisis XML en la librería multimedia de WordPress que...

ROOT-OS-DEBIAN-13-CVE-2026-56409 CVE-2026-56409 in expat - Patched by Root

Root has patched CVE-2026-56409 in the expat package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-56409 CVE-2026-56409 in expat - Patched by Root

Root has patched CVE-2026-56409 in the expat package for Root:Debian:12. Multiple fixed versions available...

CVE-2017-9805

CVE-2017-9805: Apache Struts 2 S2-052 RCE Analizi Bu depo, Apache Struts 2 S2-052 üzerindeki XStream deserialization zafiyetine yönelik teknik detayları ve PoC Proof of Concept çalışmasını içermektedir. 📌 Zafiyet Bilgileri CVE Kodu: CVE-2017-9805 Zafiyet Türü: Uzaktan Kod Çalıştırma RCE Risk...

CVE-2026-82669

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out...

EUVD-2026-68453

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out...