CVE-2025-38001

CVE-2025-38001 RBTree Family Drama Linux HFSC Eltree Use-After-Free - Debian 12 PoC This PoC utilizes a page-level data-only attack based on RBTree transformations to compromise the system. The exploit is portable and works on all kernelCTF instances LTS 6.6.90, COS 109, COS 105 and Debian 12. On...

CVE-2026-43499-aristotle

CVE-2026-43499 — aristotle au/KDDI Xiaomi XIG04 Local privilege escalation tmp-root for the au/KDDI Xiaomi "aristotle" XIG04 on Android 12 , via CVE-2026-43499. It is a device-owner rooting primitive: it roots your own phone e.g. to re-enable ADB when developer options are unreachable. This is an...

CVE-2020-3766_APSB20-12

CVE-2020-3766APSB20-12 https://vulners.com/cve/CVE-2020-3766 https://helpx.adobe.com/security/products/integrityservice/apsb20-12.html...

ROOT-OS-DEBIAN-12-CVE-2026-78410 CVE-2026-78410 in util-linux - Patched by Root

Root has patched CVE-2026-78410 in the util-linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-78409 CVE-2026-78409 in util-linux - Patched by Root

Root has patched CVE-2026-78409 in the util-linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-76642 CVE-2026-76642 in util-linux - Patched by Root

Root has patched CVE-2026-76642 in the util-linux package for Root:Debian:12. Multiple fixed versions available...

OsirisJailbreak12

OsirisJailbreak12 iOS 12.0 - 12.1.2 Incomplete Jailbreak with CVE-2019-6225 An incomplete iOS 12 Jailbreak. For now it only runs the exploit, gets tfp0, gets ROOT, escapes the SandBox, writes a test file to prove the sandbox was escaped then resprings. Feel free to build on top of it as long as y...

go-pkcs12

package pkcs12 import "software.sslmate.com/src/go-pkcs12" Package pkcs12 implements some of PKCS12 also known as P12 or PFX. It is intended for decoding DER-encoded P12/PFX files for use with the crypto/tls package, and for encoding P12/PFX files for use by legacy applications which do not suppo...

ictf-framework

The iCTF Framework 3.0 This is the framework that Shellphish uses to host the iCTF. The iCTF Framework is described in a paper presented at the Usenix 3GSE workshop in 2014. We released this in the hope that it allows educators and trainers to host their own A/D CTFs. This framework is free for...

used_sock

usedsock Kernel exploit for iOS 12-12.2 and 12.4. This isn't meant to be used in a jailbreak. You can find the writeup here...

android_autorooter

Android Autorooter This is just a mental note more than anything to further explore the posibilities of the work done here: https://rtx.meta.security/exploitation/2024/03/04/Android-run-as-forgery.html...

CVE-2026-6837-zyxel-export-cgi-command-injection

CVE-2026-6837: Zyxel export-cgi PKCS12 Command Injection This repository packages the public writeup, quick verification script, and supporting evidence for CVE-2026-6837. What this is CVE-2026-6837 is a post-authentication command-injection flaw in Zyxel's export-cgi handler. On the...

freebsd_kernel_hacking

FreeBSD Kernel Hacking Exercises from Joseph Kong's Designing BSD Rootkits, updated for FreeBSD 11/12. Even though the book is over 10 years old, it's highly recommended as it's quite a challenge to update the source code provided in the book to work on modern releases. Further Resources:...

CVE-2015-8543_for_SLE12SP1

$cat /etc/-release PRETTYNAME="SUSE Linux Enterprise Server 12 SP1" $id uid=1000jeremysp1 gid=100users groups=100users $sudo sh disablesecurity.sh $gcc exp.c -o exp 2/dev/null $../nsjail/nsjail -Mo --user 0 --group 0 --keepcaps --chroot / -- /bin/sh -i sh-4.2 /home/jeremysp1/nullpointerderf/exp +...

CVE-2025-11187

CVE-2025-11187 Stack buffer overflow in PKCS12 PBMAC1 PBKDF2 keylength OpenSSL 3.X Found this stack buffer overflow like a year ago, turned out to be a duplicate CVE-2025-11187 issue occurs in libcrypto's PKCS PBMAC1 handling when PBKDF2's keylength is attacker-controlled, It causes a write past ...

CVE-2020-14882

CVE-2020-14882 Weblogic 10 weblogic 10 Weblogic 12 weblogic 12...

PoC_iOS12

PoCiOS12 PoC Exploit iOS 12 to iOS 12.1 CVE-2018-4431 Kernel is available for: iPhone 5s and later, iPad Air and later and iPod Touch 6th generation...

CVE-2026-97873

In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 PKCS5 scheme 1 and PKCS12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before...

CVE-2026-97873 Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider

In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 PKCS5 scheme 1 and PKCS12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before...

CVE-2026-97873 Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider

In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 PKCS5 scheme 1 and PKCS12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before...