29402 matches found
TimeAfterFree
TimeAfterFree PHP 8 sandbox escape PoC demonstrating a disablefunctions bypass on Unix-like systems. This exploit leverages a use-after-free bug to bypass disablefunctions and execute system commands. The exploitation techniques used for leaking heap pointers and obtaining read/write primitives...
leaky-vessels-dynamic-detector
WARNING This repository is now archived. No more updates will be made to the code and it may be insecure or even broken by the time you read this notice. Consider it for historical purpose only and treat it carefully. Leaky Vessels Dynamic Detector In this repository you'll find a reference...
CVE-2026-22686
Enclave VM Sandbox Escape CTF Challenge Challenge: "Breaking the Walls" Difficulty: Hard Category: Source Code Review / Sandbox Escape Points: 500 Scenario You've discovered a mysterious sandboxed JavaScript execution environment...
CVE-2026-27597
CVE-2026-27597 - version Remote Code Execution Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: CRITICAL CVSS: 10.0 Impact: Confidentiality, Integrity, Availability Published: 2026-02-25 Technical Summary Enclave is a secure...
CVE-2025-6558-exp
CVE-2025-6558 - Google Chrome ANGLE/GPU Sandbox Escape Field| Details ---|--- CVE ID| CVE-2025-6558 Vulnerability Type| Sandbox Escape Affected Application| Google Chrome ANGLE and GPU components Severity| Critical – Enables remote arbitrary code execution and access to sensitive resources Affect...
secpub
Cisco Nexus OS NX-OS - Command "injection" / sanitization issues. Discovered by: Peter Adkins [email protected] Access: Local; authenticated access is required. Tracking and identifiers: CVE - CVE-2011-2569 OS' Affected: Cisco Nexus OS NX-OS Vendor involvement: Alerted - patches available /...
Container_escape
Disposable Ubuntu container VM This directory builds and runs an Ubuntu Docker container inside a disposable Ubuntu QEMU guest. PoCs are copied into the guest and are never executed by the host scripts. Host dependencies Bash QEMU x86-64 and qemu-img curl OpenSSH client tools xorriso socat only...
ipv6_frag_escape
IPV6FRAGESCAPE A reliable unprivileged container / jail escape proof of concept for CentOS / RHEL 10. It rides a now fixed IPv6 fragmentation bug in ip6appenddata closed upstream by 38becddc, no CVE, an in-slab linear overflow into the skbsharedinfo at the tail of a packet's own head object. This...
CVE-2023-30547
CVE-2023-30547 Vulnerability description vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside handleException...
DEBIAN-CVE-2026-115889
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make...
CVE-2026-115893
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm brtable instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary...
CVE-2026-115889
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make...
V8-sbx-bypass-collection
V8 Sandbox escape/bypass/violation and VR collection A collection of links related to V8 sandbox VR and exploitation Contents IssueTracker Articles Papers & Slides Design documents IssueTracker 2023: "issue id: 40940619, V8 Sandbox escape due to type tags in ExternalPointerTable being too coarse...
CVE-2025-43529
CVE-2025-43529 TL; DR Apple recently shipped iOS 26.2 and iPadOS 26.2, along with a security advisory that includes fixes for WebKit vulnerabilities. One bug in the DFG JIT compiler CVE-2025-43529 stood out, so I decided to dig into it. The JIT compiler correctly recognized that a Phi node where...
GHSA-897F-G5GM-FMXM Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Summary In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is...
cve-2018-4233
CVE-2018-4233 Exploit for CVE-2018-4233, a bug in the JIT compiler of WebKit. Tested on Safari 11.0.3 on macOS 10.13.3. For more details see https://saelo.github.io/presentations/blackhatus18attackingclientsidejitcompilers.pdf The exploit gains arbitrary memory read/write by constructing the addr...
GHSA-XMJ3-9GF7-H52W setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
Summary On Windows, attacker-controlled content in a wheel's .dist-info/namespacepackages.txt can cause setuptools' legacy wheel installation path to create an init.py outside the requested destinationeggdir. The attacker can influence the destination path, but not the contents of the created fil...
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
Summary On Windows, attacker-controlled content in a wheel's .dist-info/namespacepackages.txt can cause setuptools' legacy wheel installation path to create an init.py outside the requested destinationeggdir. The attacker can influence the destination path, but not the contents of the created fil...
filebuster
Filebuster An extremely fast and flexible web fuzzer What is it? Filebuster is a HTTP fuzzer / content discovery script with loads of features and built to be easy to use and fast! It uses one of the fastest HTTP classes in the world of PERL - Furl::HTTP. Also the thread modelling is optimized to...
