nginx-rift-check

nginx-rift-check 发现存在 CVE-2026-42945 漏洞的配置，该漏洞是 nginx 的 ngxhttprewritemodule 中的堆缓冲区溢出。 仅运行受影响的 nginx 版本（0.6.27 到 1.30.0）并不足以被利用。配置必须包含一对特定的指令，而这对指令很罕见：两次对真实世界配置的独立扫描分别在 1465 个配置中发现 0 个可利用配置、在 35633 个中发现 1 个。本脚本会告诉你，你处于这条线的哪一侧。 它查找什么 一个 rewrite，其替换内容包含一个? 且后面带有参数，随后在同一个 location 中读取一个未命名捕获组 （$1 到...

CVE-2026-14669

CVE-2026-14669 - PostgreSQL tochar Timezone Abbreviation Heap Buffer Overflow PostgreSQL tochar 函数在处理时区格式化时存在堆缓冲区溢出漏洞。攻击者通过设置超长 POSIX 时区缩写，可触发 25 字节固定缓冲区的越界写入，配合信息泄漏与 ROP 链实现远程代码执行。 漏洞信息 CVE 编号 : CVE-2026-14669 CVSS 评分 : 8.8 高危 漏洞类型 : 堆缓冲区溢出 → 远程代码执行 影响组件 : PostgreSQL tochartimestamptz 函数 发现团队 :...

Apache-Lua-Buffer-Overflow-Exploit-CVE-2021-44790

🔥 CVE-2021-44790 - Apache modlua 缓冲区溢出利用 📋 概述 Apache modlua 缓冲区溢出利用 是一个针对 CVE-2021-44790 的高级企业级利用平台。CVE-2021-44790 是 Apache HTTP Server 2.4.x modlua 模块中的一个严重缓冲区溢出漏洞。该框架提供全面的指纹识别、智能脚本发现、多阶段扫描和专业报告功能，检测置信度高达 95% 以上 。 ⚡ 主要功能 功能| 描述 ---|--- 🔍 高级指纹识别| Apache 版本、modlua、操作系统、架构、WAF、CDN、容器、云服务商检测 🎯 智能发现|...

CVE-2026-22013-Hardware-Wallet-USB-Descriptor-Buffer-Overflow

CVE-2026-22013 – 硬件钱包 USB 描述符缓冲区溢出 程序代码（C 固件模拟） // hwwalletusb.c - USB descriptor parsing with fixed buffer include void handleusbsetupchar data, int len char descriptor32; if len 0 && data0 == 0x06 // GETDESCRIPTOR // Copy descriptor payload without bounds check memcpydescriptor, data+1, len-1; ...

CVE-2026-2222-MQTT-Broker-CONNECT-Packet-Heap-Overflow

CVE-2026-2222 – MQTT Broker CONNECT 数据包堆溢出 程序代码（C + Python） // mqttbrokersim.c - Simulated vulnerable MQTT broker include include include struct mqttconnect char protocolname8; uint8t protocollevel; uint8t flags; uint16t keepalive; // remaining length field misinterpreted ; void...

CVE-2026-93546

The Apache HTTP Server (version 2.4.68 and prior) is vulnerable to an integer overflow in the mod_dav_fs component. An authenticated WebDAV client with write access can crash worker processes and cause persistent corruption of a directory's property database. This is achieved by sending PROPPATCH...

CVE-2026-93546 Apache HTTP Server: mod_dav_fs namespace overflow

Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...

EUVD-2026-90910

Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...

CVE-2026-93546

Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...

exploit_playground

关于 这里将发布我对公开漏洞的分析，以及我的一些 1day 漏洞。 公开漏洞分析 就我个人而言，学习一个公开漏洞的最佳方式就是逐行理解它，直到我能完全掌握这个漏洞。我会发布其中一些（过度注释的 ; ）漏洞分析，希望其他人也能从中学习，也算是我为社区做点贡献。同时也是为了记录，因为随着时间的推移，这些东西会逐渐从我脑海中淡去。 CVE-2016-8655 这是对 rebel 的漏洞利用 的详细分析。 感谢 rebel 提供这个超棒的漏洞利用！:D CVE-2016-5342 mp3 版本 这是 freener 的 Android LPE 漏洞利用 的注释版本。 arm32 堆溢出...

openbsd_ov1

OpenBSD TCP/IP 溢出 已在最新的 OpenBSD 7.2 上测试 详情： int ipdooptionsstruct mbuf m, struct ifnet ifp ... for ; cnt 0; cnt -= optlen, cp += optlen opt = cpIPOPTOPTVAL; if opt == IPOPTEOL break; if opt == IPOPTNOP optlen = 1; else if cnt cnt code = &cpIPOPTOLEN - uchar ip; goto bad; switch opt case IPOPTLSRR...

netbsd_hfs

NetBSD hfs 本地溢出 漏洞详情： sizet hfslibreadanodeoffsetsvoid inbytes, uint16t outoffsetarray void ptr; if inbytes == NULL || outoffsetarray == NULL return 0; ptr = inbytes; / The offset for record 0 which is the very last offset in the node is always equal to 14, the size of the node descriptor. So, on...

CVE-2026-12627

Fortra's Core Privileged Access Manager BoKS contains a stack-based buffer overflow vulnerability in boksautoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing...

CVE-2026-14316 Heap buffer overflow in boks_sshd revoked-key error handling

The revoked-key error path builds a human-readable failure reason using sprintf into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf writes the full message, it can write past the end of the heap allocation...

CVE-2026-14316

The boks_sshd software contains a heap buffer overflow vulnerability within its revoked-key error handling path. The root cause is the use of sprintf() to construct a human-readable failure reason into a heap buffer that is insufficiently sized for the final formatted message. This results in dat...

CVE-2026-14316 Heap buffer overflow in boks_sshd revoked-key error handling

The revoked-key error path builds a human-readable failure reason using sprintf into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf writes the full message, it can write past the end of the heap allocation...

EUVD-2026-90905

The revoked-key error path builds a human-readable failure reason using sprintf into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf writes the full message, it can write past the end of the heap allocation...

exploit_playground

关于 这里将发布我对公开漏洞利用（Public Exploits）的分析，以及我的一些 1day 漏洞利用。 公开漏洞利用分析 就我个人而言，学习一个公开漏洞利用的最好方式就是逐行理解它，直到我能够最透彻地掌握该漏洞利用。我会发布其中一些（过度注释的 ; ）漏洞利用，希望能让其他人也能从中学习，也作为回馈社区的一种尝试。同时也是为了记录存档，因为随着时间流逝，这些东西会逐渐从我脑海中淡忘。 CVE-2016-8655 这是对 rebel 的漏洞利用 的详细分析。 感谢 rebel 带来的这个出色的漏洞利用！:D CVE-2016-5342 mp3 版本 这是 freener 的...

CVE-2026-63292

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

CVE-2026-63292 Apache HTTP Server: mod_vhost_alias stack overflow

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...