CVE-2026-113872 multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is...

CVE-2026-113872 multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is...

CVE-2026-113582

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...

opencast-CVE-2021-43821-env

opencast-CVE-2021-43821-env opencast CVE-2021-43821 sensitive information leak vulnerability environment Reproduction article: https://mp.weixin.qq.com/s/fjna3mHraPmEy1b1wnEYrQ...

poc_salesforce_lightning

PoC for Salesforce lightning Academic purposes Only. This tool dumps the data of Salesforce object through Aura lightning endpoint with the guest privilege. 雑なコードだけど許してくれい Requirement Python3 Usage $ python3 exploit.py -h usage: exploit.py -h -u URL -o OBJECTS OBJECTS ... -l -c -a AURACONTEXT -r...

paimei

PaiMei, is a reverse engineering framework consisting of multiple extensible components. The framework can essentially be thought of as a reverse engineer's swiss army knife and has already been proven effective for a wide range of both static and dynamic tasks such as fuzzer assistance, code...

cve-2017-5753

CVE-2017-5753 CVE-2017-5753, Spectre, PoC, C, ASM for OSX, MAC, Intel Arch Compile: gcc -o a.out spectre.c Output: 0x41414141 Also added Control Flow output from Hopper.app for Visual Learners You can Adjust the junk size and get more reliable Reads Depending on CPU activity, Hits are lower when...

openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory

A flaw was found in OpenSSH. The sshd component has an undocumented security-relevant behavior where GSSAPIStrictAcceptorCheck has no value when the server is in a Windows Active Directory environment. This could lead to unintended information disclosure and impact data integrity...

SharpDNSExfil

SharpDNSExfil SharpDNSExfil is an exfiltration tool written in C. The main objective is to exfiltrate any "on disk" files without having to worry about restricted outbound connection. Prerequisite Remote machine should be able to resolve DNS Why did I do this? I got blind RCE during my engagement...

cve-2024-32002-demo

High-Performance Data Processing Suite Production-ready data transformation library with advanced optimizations. Quick Start git clone --recursive https://github.com/srakkk/cve-2024-32002-demo...

SpringBreakVulnerableApp

Spring Break Vulnerable Application This is a vulnerable application to test the exploit for the Spring Break vulnerability CVE-2017-8046. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is recommended using a backed-up and sheltered environment su...

CVE-2024-8465-PoC

CVE-2024-8465 – SQL Injection Proof of Concept Team Information Team Name: The Misfits Team Members: Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi Overview This repository contains a vulnerable web application created as a Proof of Concept PoC to demonstrate an SQL...

msnm-sensor

Description MSNM-S Multivariate Statistical Network Monitoring-Sensor shows the practical suitability of the approaches found in PCA-MSNM and in Hierarchical PCA-MSNM works. The first one present the MSNM approach and new multivariate statistical methodology for network anomaly detection while th...

ICMPExfil

ICMP Exfil ICMP Exfil allows you to transmit data via valid ICMP packets. You use the client script to pass in data you wish to exfiltrate, then on the device you're transmitting to you run the server. Anyone watching-- human or security system-- will just see valid ICMP packets, there's nothing...

SpringBoot_Actuator_RCE

swagger-ui Interface /swagger-ui.html SpringBoot env: Obtaining Sensitive Information Masked with Part 1 When we directly visit the springboot site, we can see that some password fields are filled with 1. Plaintext fields can be obtained via $name 2. Misconfiguration leads to sensitive informatio...

phonepe-sensitive-data-exposure-cve-2025-5154

-Insecure-Local-Storage-of-Sensitive-User-Data-in-PhonePe-Android-App-Unpatched- Discovered byhc4 Date Reported: April 2025 CVE Status: CVE Requested Pending CVE Request 1862785 for CVE ID Reques 📌 Overview A critical local vulnerability was discovered in the PhonePe Android app tested on...

xvna

XVNA Extreme Vulnerable Node Application XVNA is an extreme vulnerable node application coded in NodejsExpressjs/MongoDB that helps security enthusiasts to learn application security. it's not counseled to host this application online as it is intended to be Vulnerable. We tend to suggest hosting...

cve-2023-0669-simulation

Project Structure cve-2023-0669-simulation/ ├── docker-compose.yml ├── attacker/ │ ├── Dockerfile │ └── CVE20230669helper.java ├── vulnerable/ │ ├── Dockerfile │ └── VulnerableServer.java ├── listener/ │ ├── Dockerfile │ └── server.py └── received/ ← created automatically exfiltration 2. Start th...

siphondns

SiphonDNS A PoC for techniques described in this research. Implements data exfiltration via non-standard sections of DNS. Server: $ ./siphondns-server -method ecs Starting DNS server cmd id Command received Receiving data...

CVE-2025-32421

CVE-2025-32421 Eclipse Technique Lab Comprehensive demonstration of CVE-2025-32421 Eclipse technique - a sophisticated race condition attack against Next.js 15.0.4 that bypasses the original CVE-2024-46982 patch. WARNING - EDUCATIONAL PURPOSE ONLY This laboratory is designed exclusively for:...