CVE-2026-77214

The libexpat library (versions prior to commit 13c5f63 ) contains a heap buffer over-read vulnerability in xmlparse.c. The XML_ParseBuffer function fails to validate the caller-supplied len against the allocated buffer size when updating parser->m_bufferEnd. Consecutive calls to XML_ParseBuffe...

CVE-2026-77214

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser-mbufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XMLParseBuffer calls move...

EUVD-2026-94368

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser-mbufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XMLParseBuffer calls move...

CVE-2026-77214

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser-mbufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XMLParseBuffer calls move...

MsfMania

MsfMania MsfMania 是一款基于 Python 的高级 Payload 混淆框架，旨在规避 Windows 系统上的 EDR/AV 检测。它通过动态代码生成、多层加密（RC4）以及二进制元数据伪造，生成高度多态的可执行文件。 ⚠️ 仅限教育用途 —— 本工具仅适用于授权的安全测试与研究。 目录 截图 功能特性 环境要求 安装 使用方法 基本帮助 完整示例 免责声明 许可证 截图 MsfMania 界面 | Payload 执行日志 ---|--- VirusTotal 检测结果 功能特性 多态 C 桩代码，支持变量/函数名混淆 本地内存注入（RWX）...

ldeep

============== Estado del proyecto .. image:: https://github.com/franc-pentest/ldeep/actions/workflows/python-test.yml/badge.svg :target: https://github.com/franc-pentest/ldeep/actions/workflows/python-test.yml :alt: Build status .. image:: https://badgen.net/pypi/v/ldeep :target:...

viper

Viper Frank4DD, @ May 2000 Viper is a prute force UNIX-style password cracker for passwords encrypt with crypt. It has been developed from Hale's viper 1.4 Perl program. While there are other more powerful crack programs out, this one is about studying the safety of passwords while hardware speed...

CVE-2025-55182

CVE-2025-55182 Este repositorio contiene una reproducción de prueba de concepto PoC de CVE-2025-55182 , una vulnerabilidad de seguridad crítica en React Server Components RSC que permite la ejecución de código arbitrario sin autenticación. Descripción La vulnerabilidad existe en la forma en que...

EUVD-2026-94363

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...

CVE-2026-104074 Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...

CVE-2026-104074

The Coturn software (version 4.10.0 ) is vulnerable to an uninitialized stack memory disclosure vulnerability. An unauthenticated remote attacker can leak stack memory contents by sending a TURN Allocate request without credentials. The flaw exists in the stun_init_error_response_common_str() fun...

archerysec

Support. Your generous donations will keep us motivated. Paypal: Archery Overview of the tool Note Requirements OpenVAS OWASP Zap Burp Scanner SSLScan Nikto NMAP Vulners Installation Windows Installation Note on installation for developers and contributors Note on manual and automated installatio...

CVE-2026-93452

A flaw was found in snappy-java. An attacker can trigger a buffer overflow vulnerability in the Snappy.compressByteBuffer, ByteBuffer function by providing specially crafted, incompressible data. This vulnerability allows the attacker to write past the end of the destination buffer, corrupting...

CVE-2026-107125 XnView Classic FLI File heap-based overflow

A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument startingline causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address...

CVE-2026-107125 XnView Classic FLI File heap-based overflow

A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument startingline causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address...

CVE-2026-107125

A heap-based buffer overflow vulnerability exists in XnView Classic version 2.52.5 within an unknown function of the FLI File Parser component. The flaw is triggered by the manipulation of the starting_line argument, which can lead to remote exploitation. To mitigate this issue, it is recommended...

EUVD-2026-94360

A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument startingline causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address...

exrop

Exrop Automatic ROP chain generator for x86-64 binaries, powered by Triton symbolic execution. Features Set registers to constants or other registers rdi=0x41414141, rdi=rax Write to memory constant and register-based addresses/values Write strings/bytes to memory Function calls with mixed...

CVE-2023-38891

CVE-2023-38891 VTiger开源CRM v7.5中的已验证SQL注入漏洞 发现者: Jacob Elliott 2023年7月13日 摘要 在VTiger CRM v7.5.0的报表模块中，对报表所选字段的检查不足，这些字段被存储，随后在运行报表时作为二阶SQL注入被重新引入。这允许攻击者从数据库中泄露任意字段，包括用户密码哈希、Web服务API访问密钥以及其他敏感数据。 概念验证 通过CRM验证后，用户可以浏览到报表模块并创建新报表。 由于表的连接方式，最好选择一个包含记录的表单作为主模块。我选择了包含一条记录的"联系人"。...

perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting

A flaw was found in perl-DBI. When casting numeric values to the SQLNUMERIC type using the sqltypecast function, the component incorrectly handles numeric values as strings without converting them first. An attacker capable of supplying numeric input to an affected application can trigger an...