CVE-2026-86463

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafte...

CVE-2026-86463

The Apache CXF FIQL query parser is vulnerable to a Denial of Service condition due to an issue in how it searches for operators within query expressions. When the parser encounters a long string without an operator, it may attempt numerous combinations, leading to excessive CPU consumption . An ...

EUVD-2026-95698

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafte...

CVE-2026-86463 Apache CXF: FIQL Query Parser Denial of Service

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafte...

cve-2024-4577-phpcgi_rce_reproduction

CVE-2024-4577 - PHP CGI Argument Injection on Windows "WorstFit" Overview CVE-2024-4577 is a critical remote code execution vulnerability in PHP's CGI implementation on Windows. It bypasses the fix for the original CVE-2012-1823 by exploiting Windows "Best-Fit" code page conversion to smuggle...

CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter

CVE-2026-11101 – HTTP Cache Poisoning via Unkeyed Query Parameter Overview A web cache uses only the URL path as the cache key, ignoring query parameters. An attacker can append a malicious payload to an unkeyed parameter e.g., utmcampaign and poison the cache. Subsequent visitors receive the...

dnsprobe

Nota - Este proyecto está discontinuado. Las nuevas actualizaciones y correcciones se enviarán a dnsx. DNSProbe es una herramienta construida sobre retryabledns que permite realizar múltiples consultas DNS de su elección con una lista de resolutores proporcionados por el usuario. Recursos Recurso...

Gitmails

Development - IMPORTANT This Gitmails version is no longer maintained. Check out the Gitmails Shell port if you want to use a version that is maintained and, hopefully, developed. If you do not want to use the shell port and prefer the Python version, feel free to fork Gitmails and direct it to...

CVE-2026-21004-SQLite-FTS3-Match-Infoleak-via-Query-Crafting

CVE-2026-21004 – SQLite FTS3 Match Infoleak via Query Crafting Program Code Python sqliteftsleak.py - Creates FTS table and exploits match info import sqlite3 conn = sqlite3.connect':memory:' conn.execute"CREATE VIRTUAL TABLE secrets USING fts4content TEXT" conn.execute"INSERT INTO secrets VALUES...

CVE-2012-1823---PHP-CGI---RCE

CVE-2012-1823 | PHP-CGI Remote Code Execution RCE Exploit A Python-based exploit for CVE-2012-1823. This vulnerability allows an attacker to execute arbitrary code on a server running a vulnerable version of PHP-CGI by injecting command-line arguments via the query string. 📝 Vulnerability Overvie...

Apache Solr <= 7.1 - XML Entity Injection

Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

CLEANSTART-2026-LO86416 net/url package does not set a limit on the number of query parameters in a query

Security vulnerability affects the victoria-metrics package. The net/url package does not set a limit on the number of query parameters in a query...

EUVD-2026-95351

Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allows unauthenticated attackers to inject script via unencoded tagID and count parameters. Attackers can craft a link with a script-closing...

dns-honeypot

My First 24 Hours Running a DNS Honeypot As an engineer who spends most of my days knee-deep in observability tooling, I get the occasional idea that I just have to run with. This was one of those experiments: spin up a DNS resolver on a clean IP that nobody advertises, then let the internet talk...

CVE-2025-2945-pgAdmin4-Authenticated-RCE-PoC-

CVE-2025-2945 – pgAdmin4 Authenticated RCE PoC This repository contains a proof-of-concept script created for security research and authorized penetration testing involving the vulnerability CVE-2025-2945 , affecting certain versions of pgAdmin4. The issue allows an authenticated pgAdmin user wit...

CVE-2025-46171

vBulletin 3.x.x - DoS via Buddy List Overload Summary The /misc.php?do=buddylist endpoint runs a single, large JOIN query that retrieves all buddies along with their user and session information to check online status. Because this query processes the entire buddy list without pagination or resul...

PT-2026-108818

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The FIQL query parser contains a flaw in its operator search mechanism. When processing a long string that lacks an operator,...

0-click-RCE-Exploit-for-CVE-2024-50498

CVE-2024-50498 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858512517774868845 This repository contains a proof-of-concept exploit for CVE-2024-50498, an unauthenticated code injection vulnerability in the LUBUS WP Query Console WordPress plugin, leading to...

CVE-2026-78399

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources...

CVE-2026-78399 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources...