PS4-6.20-WebKit-Code-Execution-Exploit

PS4 6.20 WebKit Code Execution PoC This repo contains a proof-of-concept PoC RCE exploit targeting the PlayStation 4 on firmware 6.20 leveraging CVE-2018-4441. The exploit first establishes an arbitrary read/write primitive as well as an arbitrary object address leak in wkexploit.js. It will then...

CVE-2024-23897

CVE-2024-23897 Jenkins CVE-2024-23897: Arbitrary File Read Vulnerability Leading to RCE Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an @ character followed by a file...

PoC-CVE-2021-41773

CVE-2021-41773 Apache HTTP Server Path Traversal Exploit A Python exploit for CVE-2021-41773, a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows reading arbitrary files from the server. Vulnerability Details CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Serv...

mpDNS

mpDNS aka multi-purpose DNS Server Simple, configurable DNS Server with multiple useful features Python 3 names.db - holds all custom records see examples Simple wildcards like .example.com Catch unicode dns requests Custom actions aka macro: shellexec::dig google.com +short - Execute shell comma...

CVE-2026-127916 MCUboot image hash span is not bounded against the slot, allowing a read past the flash area during image validation

bootutilimghash computes the image digest over ihhdrsize + ihimgsize + ihprotecttlvsize bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The three sizes are also summed without an overflow check. Nothing...

EUVD-2026-124792

bootutilimghash computes the image digest over ihhdrsize + ihimgsize + ihprotecttlvsize bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The three sizes are also summed without an overflow check. Nothing...

CVE-2026-127916

The MCUboot bootloader contains a vulnerability in bootutil_img_hash() where the image hash calculation spans a memory range that is not bounded against the flash slot. This occurs because the function sums ih_hdr_size, ih_img_size, and ih_protect_tlv_size from the image header without overflow c...

CVE-2026-127915

The MCUboot bootloader contains an out-of-bounds read vulnerability in the bootutil_tlv_iter_next() function within boot/bootutil/src/tlv.c. The iterator fails to validate that the header and payload of each TLV entry stay within the declared tlv_end boundary, potentially allowing it to read up t...

CVE-2026-127915 TLV iterator does not bound each entry against the declared TLV area in MCUboot bootutil

The MCUboot TLV iterator bootutiltlviternext in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loop guard it-tlvoff tlvend and advances by sizeofstruct imagetlv + tlv.itlen using the attacker-controlled itlen field, without validating that the entry's header or payload stays withi...

EUVD-2026-124790

MCUboot's Zephyr serial-recovery upload handler bsupload in boot/bootserial/src/bootserial.c decodes the host-supplied image field of an MCUmgr image-upload request into imgnum a full 32-bit value and latches it on the off == 0 packet without any range check. It then passes imgnum straight to...

CVE-2026-16664

The MCUboot bootloader's Zephyr port contains an out-of-bounds read (CWE-192) in the bs_upload() handler within boot/boot_serial/src/boot_serial.c. The vulnerability occurs because the host-supplied img_num from an MCUmgr image-upload request is processed without a range check before being used t...

CVE-2022-44268-MagiLeak

ImageMagick Arbitrary Read Files - CVE-2022-44268 This repository contains a proof-of-concept PoC code for exploiting the arbitrary file read vulnerability CVE-2022-44268 in ImageMagick. The PoC demonstrates how an attacker can leverage the vulnerability to read arbitrary files on the system...

CitrixBleed-2-CVE-2025-5777-PoC-

CitrixBleed 2 CVE-2025-5777 Ultimate Analysis An Out-of-Bounds Memory Read in NetScaler ADC / Gateway — A Comprehensive Guide from Root Cause to Offensive and Defensive Exercises poc usage: python3 poc.py https://gateway.example.com exp usage: python3 exp.py https://gateway.example.com admin...

CVE-2024-38816-PoC

CVE-2024-38816 Proof of Concept PoC This is a proof of concept for the CVE-2024-38816 vulnerability, demonstrating a path traversal exploit. Execution Steps 1. Build the Docker image: Spring Boot 3.0.13, based on Spring Framework 6.0.3 docker build -t cve-2024-38816-poc . 2. Run the container and...

CVE-2006-3392

CVE-2006-3392 About the vulnerability A vulnerability has been reported in Webmin and Usermin, which can be exploited by malicious people to disclose potentially sensitive information. The vulnerability is caused due to an unspecified error within the handling of an URL. This can be exploited to...

CVE-2024-4956

CVE-2024-4956 Quick and easy exploitation of CVE-2024-4956 for LFI based on original PoC from: VeryLazyTech, https://github.com/verylazytech/CVE-2024-4956. This implementation takes 2 arguments, url and file, and presents the output of the file if it is found...

CVE-2021-26085

CVE-2021-26085 Atlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability POC Vulnerable Endpoints: WEB-INF/web.xml WEB-INF/decorators.xml WEB-INF/classes/seraph-config.xml META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.properties...

CVE-2026-128067: python-pillow Pillow: Pillow is a Python imaging library

Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through libtiff can pass attacker-controlled image geometry tags to the encoder while allocating its row buffer from the actual image dimensions. The affected TiffImagePlugin.save...

PT-2026-146107

bootutil img hash computes the image digest over ih hdr size + ih img size + ih protect tlv size bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The three sizes are also summed without an overflow check...

mackron dr_libs dr_mp3 drmp3_init_internal out-of-bounds read vulnerability

Summary A out-of-bounds read vulnerability exists in the drmp3 drmp3initinternal functionality of drlibs versions: 0.7.3. A specially crafted .mp3 file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability. Confirmed Vulnerable Versions The...