PhantomCtx

PhantomCtx PhantomCtx is a tool that automates Activation Context hijacking with the objective of loading an arbitrary DLL into the vast majority of signed executables e.g. Microsoft, Adobe, Mozilla. The loader is presented as a modern alternative to traditional DLL Hijacking & Sideloading: unlik...

Tai-e

Tai-e ✨News Our paper "When Absence Speaks: A Null-Aware Approach for Taint Analysis" has been accepted by ICSE'27. This work presents a simple yet effective approach for recovering missing taint flows, substantially improving the vulnerability detection capability of Tai-e's general-purpose Java...

CVE-2024-6769

Blogpost: CVE-2024-6769 Poisoning the activation cache to elevate from medium to high integrity This blog is about two chained bugs: Stage one is a DLL Hijacking bug caused by the remapping of ROOT drive and stage two is an Activation Cache Poisoning bug managed by the CSRSS server. The first sta...

RemotePotato0

RemotePotato0 UPDATE 21-10-2022: The main exploit scenario RPC- LDAP of RemotePotato0 has been fixed. More details at -- https://twitter.com/splintercode/status/1583555613950255104 Just another "Won't Fix" Windows Privilege Escalation from User to Domain Admin. RemotePotato0 is an exploit that...

CVE-2025-52289

CVE-2025-52289: Broken Access Control in MagnusBilling v7.8.5.3 Description A Broken Access Control vulnerability exists in MagnusBilling versions prior to v7.8.5.3. Newly registered users can escalate their account status from pending to active without administrator approval by modifying a reque...

ListingPro < 2.6.1 - Arbitrary Plugin Installation/Activation/Deactivation

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lpccaddonsactions function. This makes it possible for unauthenticated attacker...

CVE-2025-65320

CVE-2025-65320 CVE-2025-65320: Cleartext Storage of Sensitive Information in Memory in Abacre Restaurant Point of Sale POS. All versions of Abacre Restaurant Point of Sale POS up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid...

CVE-2025-65320

CVE-2025-65320 Title Cleartext Storage of Sensitive Licensing Material in Process Memory in Abacre Restaurant Point of Sale POS Overview A vulnerability exists in Abacre Restaurant Point of Sale POS versions = 15.0.0.1656 where sensitive licensing data is stored in cleartext in process memory...

CVE-2023-36531

CVE-2023-36531 LiquidPoll – Advanced Polls for Creators and Brands = 3.3.68 - Missing Authorization via activateaddon Info Needs a subscriber level user and the plugin needs to be disabled. This will activate the plugin you provide. Usage usage: CVE-2023-36531.py -h -w URL -u USERNAME -p PASSWORD...

CVE-2024-30485

CVE-2024-30485 Exploit 📌 Overview CVE-2024-30485 is a high-severity vulnerability found in the Finale Lite plugin for WordPress versions = 2.18.0. The vulnerability allows authenticated users Subscriber+ to install and activate arbitrary plugins without proper authorization. Severity : HIGH CVSS...

CVE-2025-55319-PoC

Reference: CVE-2025-55319 Proof-of-concept VS Code .vsix extension for the HTB "Checkpoint" challenge. Once installed, the extension auto-activates and spawns a hidden PowerShell reverse shell back to the attacker. ⚠️ Authorized use only. This is a CTF/lab artifact. Only deploy it against machines...

CVE-2023-30486

CVE-2023-30486 Square = 2.0.0 - Missing Authorization via activateplugin Description The Square theme for WordPress is vulnerable to unauthorized plugin activation due to a missing capability check on the activateplugin function called via an AJAX action in versions up to, and including, 2.0.0...

CVE-2026-23111

CVE-2026-23111 PoC Linux Kernel nftables Use-After-Free Local Privilege Escalation poc by baba01hacker Vulnerability Summary CVE : CVE-2026-23111 Type : Use-After-Free CWE-416 CVSS : 7.8 HIGH Component : net/netfilter/nftablesapi.c — nftmapcatchallactivate Root Cause : Inverted genmask check caus...

azpim

Azure PIM CLI azpim A command-line interface tool for managing Azure Privileged Identity Management PIM role activations directly from your terminal. Features 🔐 Role Activation - Quickly activate eligible Azure PIM roles 🔓 Role Deactivation - Deactivate active roles when no longer needed 📋...

CVE-2024-25092

CVE-2024-25092 NextMove Lite 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation Description: The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'xladdoninstallation' functio...

IntelTXE-PoC

Disclaimer All information is provided for educational purposes only. Follow these instructions at your own risk. Neither the authors nor their employer are responsible for any direct or consequential damage or loss arising from any person or organization acting or failing to act on the basis of...

AndroRAT

AndroRAT Remote Administration Tool for Android Androrat is a client/server application developed in Java Android for the client side and in Java/Swing for the Server. The name Androrat is a mix of Android and RAT Remote Access Tool. It has been developed in a team of 4 for a university project. ...

rpc2wc

RPC to WebClient The information for this code can be found at this blog post. Recommend reading before attempting to use anything here. Code for triggering WebClient through an RPC call. Since it did not end up panning out the code was never very cleaned up and very much remained in a proof of...

CVE-2026-109231

The Germanized for WooCommerce plugin for WordPress (versions

EUVD-2026-114696

The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the onuseremailchanged hook — which is responsible for rotating the activation token and recording a...