boa-cve-2009-4496-analysis

CVE-2009-4496 — Defensive Vulnerability Analysis Overview This repository documents a defensive analysis of CVE-2009-4496 , a historical vulnerability associated with the Boa web server. The objective of this project is to examine the vulnerability from a defensive security perspective through:...

duplicut

Duplicut :scissors: Quickly dedupe massive wordlists, without changing the order Created by nil0x42 and contributors 📖 Overview Nowadays, password wordlist creation usually implies concatenating multiple data sources. Ideally, most probable passwords should stand at start of the wordlist, so most...

CVE-2025-25369

CVE-2025-25369: Cross Site Scripting vulnerability in ZKTeco ZKBio CVSecurity v.6.4.1 An XSS vulnerability was discovered in ZKBio CVSecurity v.6.4.1. An attacker could exploit this vulnerability with Template Editor privileges and escalate their privileges to administrator. Bypassing the built-i...

CVE-2021-3129

CVE-2021-3129 Generate a phar package with custom commands: php -d'phar.readonly=0' ./phpggc monolog/rce1 system "cat /etc/passwd" --phar phar -o php://output | base64 -w0 php -a enter the php command line environment $fp = fopen'php://output', 'w'; streamfilterappend$fp,...

Astra Linux – Vulnerability in PHP 7.3, PHP 8.1

In PHP versions 8.1. before 8.1.31, and 8.2. before 8.2.26, as well as 8.3. before 8.3.14, a bug in the convert.quoted-printable-decode filter can cause certain data to be read as one byte too much. This can, under certain circumstances, lead to crashes or reveal content from other memory areas...

PT-2026-105119

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

PT-2026-105149

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

PT-2026-105139

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

SUSE CVE-2026-92842

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

CVE-2026-100889

A flaw was found in OpenDKIM. An off-by-one boundary error in the quoted-printable decoder function dkimqpdecode allows a remote attacker to trigger memory corruption by submitting specially crafted input. This issue primarily causes the application to crash, leading to a Denial of Service DoS...

AZL-104898 CVE-2026-92842 affecting package php 8.3.33-1

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

DEBIAN-CVE-2026-92842

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

CVE-2026-92842

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

UBUNTU-CVE-2026-92842

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

CVE-2026-92842

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

CVE-2026-92842

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

CVE-2026-92842

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

CVE-2026-92842

The PHP language is vulnerable to an out-of-bounds read and information leak in the convert.base64-encode, convert.quoted-printable-encode, and convert.quoted-printable-decode stream filters. The root cause is that the line-break-chars option's length is tracked independently of the string itself...

CVE-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

EUVD-2026-87351

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...