298 matches found
faxhell
faxhell "Fax Shell" A Proof-of-Concept bind shell using the Fax service and a DLL hijack based on Ualapi.dll. See our writeup at: https://windows-internals.com/faxing-your-way-to-system/ How to use Build Ualapi.dll and place in c:\windows\system32 Start the Fax service, which will load the DLL an...
ImpulsiveDLLHijack
ImpulsiveDLLHijack Cベースのツールで、対象のバイナリにおけるDLLハイジャックの発見と悪用を自動化します。発見されたハイジャックパスは、後でRedTeam運用においてEDRを回避するために武器化できます。 1. 方法論的アプローチ： このツールは基本的に、DLLハイジャックのために実行される以下の段階を自動化します。 発見 - 潜在的に脆弱なDLLハイジャックパスの発見 悪用 - 確認用DLLがハイジャックされたパスから読み込まれたことを確認し、100%悪用可能なDLLハイジャックであることを確認 発見方法論：...
RP_RecordClip_DLL_Hijack
Remote DLL Hijack Vulnerability in Real Player CVE-2022-32291 Player アプリケーション（Real Converter の起動時に脆弱性が発現する）と Recording Manager は、存在しない DLL を安全でない方法で検索するため、リモート DLL ハイジャック（バイナリプランティング）の問題に対して脆弱です。 この問題を悪用するには、攻撃者は標的に WebDAV または SMB 共有のメディアファイルを開かせる必要があります。 V.20.1.0.312 より前の Real Player の場合: RAM...
CVE-2026-41447
FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files x86\Common Files\SSL\ directory path. Attackers can write a malicious OpenSSL configuration...
CVE-2026-16519 GeoVision GV-IP Device Utility DLL Search Order Hijacking Vulnerability
A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library locatio...
CVE-2026-38972
Notepad3 versions through 6.25.822.1 are vulnerable to a DLL search-order hijacking vulnerability in the About-dialog code path located in src/Notepad3.c. The software calls `LoadLibrary(L
PT-2026-54909
Name of the Vulnerable Software and Affected Versions PACSgear MediaWriter version 5.2.1 Description An unauthenticated remote attacker can read and write arbitrary files on the host filesystem by exploiting a .NET Remoting TCP service exposed on port 9000 via PacsgearMediaServerEngine.dll. This ...
CVE-2026-32679
The installers of LiveOn Meet Client for Windows Downloader5Installer.exe and Downloader5InstallerForAdmin.exe and the installers of Canon Network Camera Plugin CanonNWCamPlugin.exe and CanonNWCamPluginForAdmin.exe insecurely load Dynamic Link Libraries DLLs. If a malicious DLL is placed at the...
IMVU-Exploits
IMVU Exploits IMVU Classic Client v3.6.15 - Complete exploita...
AMD Graphics Vulnerabilities – May 2026
CVE Details Refer to Glossary for explanation of terms CVE ID| CVE Description| CVSS Vector ---|---|--- CVE-2024-36323| Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine VM or a process to perform unauthorized access to the register space of the JPEG...
CVE-2026-32679
CVE-2026-32679 affects LiveOn Meet Client for Windows and Canon Network Camera Plugin installers (Downloader5Installer.exe, Downloader5InstallerForAdmin.exe, CanonNWCamPlugin.exe, CanonNWCamPluginForAdmin.exe). The installers insecurely load DLLs from the same directory; if a malicious DLL is pre...
CVE-2026-24317 DLL Hijacking vulnerability in SAP GUI for Windows with active GuiXT
SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this vulnerability by persuading a victim to place a malicious DLL within one of these directories. The malicious command is executed in the victim user's...
AMD Graphics Driver Vulnerabilities – February 2026
CVE Details Refer to Glossary for explanation of terms CVE| CVE Description | CVSS Score ---|---|--- CVE-2024-36324| Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbitrary code execution.| 8.8 High...
CVE-2023-53937
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application...
CVE-2023-53937 Hubstaff 1.6.14 DLL Search Order Hijacking via wow64log Library
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application...
CVE-2025-13152
A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local authenticated user to execute code with elevated privileges...
CVE-2025-66265
The CVE-2025-66265 entry concerns MegaTec ClientMate’s CMService.exe that creates the C:\usr directory and subdirectories with insecure permissions, granting write access to all authenticated users. This enables attackers to replace configuration files (e.g., snmp.conf) or hijack DLLs to escalate...
CVE-2025-13051 Windows service used an uncontrolled search path element will cause unauthorized code execution with localsystem privileges
When the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL with the same name as one loaded by the service. Upon service restart, the malicious DLL is loaded and executed under the LocalSystem account, resulting in...
PT-2025-44303
Name of the Vulnerable Software and Affected Versions Evope Collector version 1.1.6.9.0 Description A DLL hijacking issue exists in Evope Collector. The software loads the wtsapi32.dll library from an uncontrolled search path, specifically C:ProgramDataEvope. This allows a local, unprivileged...
