学习与教育

iamlucif3r/cve-2026-109618-exploit

[PHP2Shell] 针对 CVE-2026-109618 / CVE-2026-109619 的 Golang 漏洞利用程序：通过 OOM 内存破坏 + session.upload_progress 释放后使用（UAF）实现 PHP 5.4–8.5.11 中的未认证远程代码执行（RCE）

abraxas/vsftpd-ssl-data-any-ticket

vsftpd 3.0.5 - High - Remote - Privilege leftover - FTPS data accepts any resumed ticket

abraxas/vsftpd-deny-file-brace-child

vsftpd 3.0.5 - High - Remote - Privilege leftover - brace deny_file misses .private/secret

abraxas/vsftpd-cmds-denied-alias

vsftpd 3.0.5 - High - Remote - Privilege leftover - cmds_denied misses RFC aliases (XRMD)

abraxas/vbox-lsilogic-sas-config

VirtualBox 7.2.20 - Critical - Local - Type confusion / arb R/W - SAS1068 CONFIG SCSI-SPI overlay

abraxas/vbox-vmdk-sparse-extent

Oracle VM VirtualBox 7.2.20 - High - Local - File read - VMDK sparse FLAT extent path join

abraxas/vbox-ovf-nat-tftp-prefix

VirtualBox 7.2.20 - High - Local - File read - OVF NAT TFTP empty prefix

abraxas/vbox-guestctrl-copyfrom-dotdot

VirtualBox 7.2.20 - High - Local - File write - Guest Control copy-from DOTDOT

abraxas/vaultwarden-ip-header-spoof

Vaultwarden 1.37.3 default X-Real-IP trusted-local bypasses login rate limits on Docker NAT

abraxas/sqlite-xfer-auth

SQLite 3.53.4 - High - Local - Privilege leftover - INSERT SELECT xfer skips source READ

abraxas/sqlite-wal-pagesize

SQLite 3.53.4 - High - Local - Info leak - WAL/DB page-size mismatch uninitialized page tail

abraxas/sqlite-rtree-rowid0

SQLite 3.53.4 - High - Local - UAF - rtree last_insert_rowid 0 node hash

abraxas/sqlite-session-ncol

SQLite 3.53.4 - High - Local - heap OOB write - session changeset same-name nCol growth

abraxas/sqlite-values-union

SQLite 3.53.4 - High - Local - Crash - VALUES UNION ALL fallback cleanup stack overflow

abraxas/sqlite-fts5-securedel

SQLite 3.53.4 - High - Local - Crash - FTS5 secure-delete PutVarint footer overrun

abraxas/sqlite-fj-using-auth

SQLite 3.53.4 - High - Local - Privilege leftover - FULL JOIN USING skips sqlite3AuthRead