cve-2019-11043

PHP Remote Code Execution Vulnerability CVE-2019-11043 1. Background On September 26, PHP officially released a vulnerability advisory pointing out that servers using Nginx + php-fpm, under certain configurations, have a remote code execution vulnerability. Moreover, this configuration is widely...

Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion

Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion LFI vulnerability when executed under PHP's built-in CLI server PHPSAPI == 'cli-server' or non-normalizing reverse proxies. The application fails to sanitize dot-dot sequences in PATHINFO routes starting with '/:' and...

Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting

Mitel ShoreTel 19.46.1802.0 devices and their conference component are vulnerable to an unauthenticated attacker conducting reflected cross-site scripting attacks via the PATHINFO variable to index.php due to insufficient validation for the timezone object in the HOMEMEETING& page. id:...

CVE-2019-11043

CVE-2019-11043 0th3rs Security Team ====================== In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 Tested under PHP 7.2.20/7.3.10 Instructions 1、较为稳定,只要爆破出query长度和Header头字段长度 2、autosession检测漏洞存在性 3、实现判断目标worker进程数实现健壮性 4、全worker进程污染 Nginx configuration locati...

CVE-2020-28351

ShoreTel 19.46.1802.0 Reflected Cross Site Scripting Attack The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting attack XSS via the PATHINFO to index.php, due to insufficient validation for the timezo...

PHP-FPM-Remote-Code-Execution-Vulnerability-CVE-2019-11043-

CVE-2019-11043 1. Vulnerability Description When Nginx processes requests containing %0a with fastcgisplitpathinfo, it causes PATHINFO to be empty due to the newline character \n. PHP-FPM has a logic flaw when handling an empty PATHINFO. An attacker can craft a request to achieve remote code...

CVE-2019-11043

CVE-2019-11043 Vulnerability Description When Nginx's fastcgisplitpathinfo processes requests containing %0a, it encounters a newline \n causing PATHINFO to be empty. Meanwhile, php-fpm has a logic flaw when handling empty PATHINFO. An attacker can achieve remote code execution through careful...

CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-116130 HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-116130 HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-116130

The HTTP::Parser::XS Perl module (versions before 0.18 ) contains a vulnerability where the XS parser URL-decodes the request path and uses strlen() to measure the result. This causes the PATH_INFO to be truncated at the first byte decoded from an encoded NUL byte (%00 ). While the pure-Perl back...

CVE-2026-116130 HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

PHP-FPM Path Info Buffer Underflow - Remote Code Execution

In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed in certain Nginx configurations with the fastcgisplitpathinfo directive, a crafted request with an empty PATHINFO can trigger a buffer underflow in the php-fpm code. This may allow an unauthenticated remote...

CVE-2026-116130: Null Byte Interaction Error (Poison Null Byte)

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

Astra Linux – vulnerability in ruby-rack

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Staticapplicablerules evaluates several headerrules types against the raw URL-encoded PATHINFO; the underlying file-serving path is then decoded prior to serving the file. As a result, a request for a...

Exploit for Classic Buffer Overflow in Php

PHP-FPM Remote Code Execution CVE-2019-11043 Vulhubhttps...

CVE-2026-75922

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...

CVE-2026-75922

The Reverse::Proxy Perl module, in versions before 0.04 , is vulnerable to HTTP request smuggling . The issue occurs because PSGI provides a percent-decoded PATH_INFO to the application; a %XX sequence in the client URL becomes a raw byte which the proxy then appends unencoded to the upstream req...

CVE-2026-75922 Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...

EUVD-2026-64662

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...