EUVD-2026-75327

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations...

CVE-2026-88264

crun , a container runtime, is affected by a /dev/console symlink-follow flaw (CVE-2026-88264). When the container configuration does not assign a dedicated mount to /dev, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fall...

CVE-2026-88264

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations...

serval

A Netcat style backdoor for pentesting and pentest challenges Serval is a lightweight, easy-to-use, binary for spawning reverse and bind shells for pentests or pentesting exercises. Serval is cross platform and can be compiled for both Windows 32 & 64-bit and Linux 32 and 64-bit. Note: Due to the...

BIND-9-Cache-Poisoning-PoC---CVE-2025-40778

BIND 9 Cache Poisoning PoC - CVE-2025-40778 Conceptual Overview This vulnerability allows an attacker to corrupt the DNS cache of a BIND Resolver, forcing legitimate users to be redirected to malicious IP addresses without their knowledge. The core logic of the attack: The attack relies on...

CVE-2017-7494_SambaCry

CVE-2017-7494 SambaCry Exploit Exploit SambaCry CVE-2017-7494 to exploit Samba bind shell without Metasploit If you need to change the port, just change line 68 of bindshell-samba.c and recompile: root@kitploit: gcc -c -fpic bindshell-samba.c root@kitploit: gcc -shared -o libbindshell-samba.so...

CVE-2025-9074

CVE-2025-9074 – Full Docker Escape on Windows & macOS Docker Desktop 📌 Description Docker Desktop exposes the internal Docker Engine API at http://192.168.65.7:2375 to any running container — with no authentication and no access control. Because the engine itself can mount the host filesystem, a...

Open WebUI 'LDAP Empty Password' - Authentication Bypass

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...

CVE-2016-2776

CVE-2016-2776 A tale of a DNS Packet, a detailed walk-thru and proof of concept of BIND's CVE-2016-2776. http://blog.infobytesec.com/2016/10/a-tale-of-dns-packet-cve-2016-2776.html In this repository you will find: Proof-of-Concept namedown.py Metasploit Auxiliary Module namedown.rb...

copy-fail-mitigation-with-bpftrace

copy-fail-mitigation-with-bpftrace CVE-2026-31431, AKA Copy Fail, can be mitigated in one-line with bpftrace, no kpatch building, no cargo building English Version | 中文版本 Idea To exploit Copy Fail, you need to bind socket AFALG and use algorithm authencesn , which most applications don't use a lo...

pkwner

root@kitploit: ██████╗ ██╗ ██╗██╗ ██╗███╗ ██╗███████╗██████╗ ██╔══██╗██║ ██╔╝██║ ██║████╗ ██║██╔════╝██╔══██╗ ██████╔╝█████╔╝ ██║ █╗ ██║██╔██╗ ██║█████╗ ██████╔╝ ██╔═══╝ ██╔═██╗ ██║███╗██║██║╚██╗██║██╔══╝ ██╔══██╗ ██║ ██║ ██╗╚███╔███╔╝██║ ╚████║███████╗██║ ██║ ╚═╝ ╚═╝ ╚═╝ ╚══╝╚══╝ ╚═╝...

badblood

Bad Blood Bad Blood is an exploit for CVE-2021-20038, a stack-based buffer overflow in the httpd binary of SMA-100 series systems using firmware versions 10.2.1.x. I've written a lot of the technical details here: AttackerKB CVE-2021-20038 The exploit, as written, will open up a telnet bind shell...

docker-socket-risk-demos

docker-socket-risk-demos Companion repo for the video: Stop Mounting docker.sock — Run Trivy Without Giving Away Root Access — inspired by CVE-2026-33634 https://www.youtube.com/watch?v=xLTYzfPY3xI This repo contains the sample web app and Claude Code prompt used in the video to demonstrate: 1. W...

GHSA-VV4J-M4VR-F3G6 ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

Summary On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...

ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

Summary On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...

CVE-2020-8617

CVE-2020-8617 PoC for CVE-2020-8617 For educational purposes only Run This image runs a standard BIND server, which automatically generates a tkey "local-ddns". root@kitploit: $ docker run --rm --name cve-2020-8617 -it -p 53:53/udp knqyf263/cve-2020-8617 Exploit root@kitploit: $ pipenv install $...

hacktivity-vulns-exploits-lab

Vulnerabilities, Exploits, and Remote Access Payloads — lab writeup My walkthrough and analysis of the Hacktivity Cyber Security Labs sheet "Vulnerabilities, Exploits, and Remote Access Payloads" Ethical Hacking and Penetration Testing course, Leeds Beckett University. It covers how software...

CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE

CVE-2026-3888 — snap-confine / systemd-tmpfiles Local Privilege Escalation Local privilege escalation from unprivileged user to full root on Ubuntu Desktop 24.04+ by exploiting a TOCTOU race condition between snap-confine and systemd-tmpfiles. Two variants are provided: SUID and Capabilities. CVS...

CVE-2026-87806

Parse Server versions = 9.0.0 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory...

docker_cve-2015-2925

Docker + CVE-2015-2925 = escaping from --volume Recent vulnerability in Linux known for about half of the year several months publicly made it possible to escape from bind mounts. In particular in case of Docker it's possible to escape from inside the directory mounted via --volume option to the...