CVE-2026-50343-InstallService-EoP

CVE-2026-50343: InstallService StaticPluginMap EoP 표준 사용자에서 SYSTEM으로 저는 독립적으로 발견하여 CVE-2026-50343으로 추적되는 취약점을 보고했습니다. MSRC는 제 제출물을 다른 연구자의 이전 보고서와 중복된 것으로 확인했습니다. 표준 대화형 사용자는 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State 아래에 공격자 제어 플러그인 상태를 쓸 수 있습니다. Microsoft Store Install...

CVE-2026-49176_LPE_POC

CVE-2026-49176 SYSTEM Shell PoC Local privilege-escalation proof of concept for the Windows WalletService vulnerability fixed in July 2026. Technical write-up: CVE-2026-49176 Exploit Development: WalletService to SYSTEM. A standard user creates a Wallet ESE database containing a persisted callbac...

CVE-2023-38146-Poc

ThemeBleed CVE-2023-38146 エクスプロイト Windows 11 テーマ の PoC https://github.com/gabe-k/themebleed に大きく触発されました。これは Windows でのみ動作するため、自分で作成することにしました。 impacket の smbserver.py から修正したコードを使用しています https://github.com/fortra/impacket/blob/master/impacket/smbserver.py 参考:...

CVE-2023-38146

ThemeBleed CVE-2023-38146 익스플로잇 Windows 11 테마 PoC https://github.com/gabe-k/themebleed 에서 크게 영감을 받았습니다. 이 도구는 Windows에서만 실행되므로 제가 이 PoC를 작성한 이유입니다. impacket smbserver.py https://github.com/fortra/impacket/blob/master/impacket/smbserver.py 의 수정된 코드를 사용했습니다. 유용한 자료:...

ThemeBleedPy

gabek님께서 C으로 최초 PoC를 작성하고 이 CVE를 실제로 발견해 주신 데 대해 큰 감사를 드립니다. 이는 그의 코드를 파이썬으로 다시 구현하고 그의 스테이지 파일을 재사용한 것입니다. 초기 PoC를 확인하려면 여기에서 그의 페이지를 방문하세요: https://github.com/gabe-k/themebleed ThemeBleedPy CVE-2023-38146 "ThemeBleed"에 대한 파이썬 기반 개념 증명입니다. 요구 사항: 이 프로그램은 Impackets SMB 서버를 사용하며, smb2Create 함수를...

MemoryModulePP

MemoryModulePP memorymodule:https://github.com/fancycode/MemoryModule メモリからDLLをロードするライブラリ memorymoduleから変更。例外をサポート...

PT-2026-97222

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description A local privilege escalation issue exists in the updater of Foxit PDF Editor/Reader. The problem occurs because the updater unsafely loads dynamic-link libraries DLLs—which ar...

FalconFlank

FalconFlank Crowdstrike Falcon 0day Privilege Escalation Vulnerability FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it so if you want to...

CVE-2026-68955

The installer for Rakuten Kobo Desktop Application Windows version insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privileges of the user who performed the installation...

CVE-2026-68955

The Rakuten Kobo Desktop Application Windows installer is vulnerable to DLL search-order hijacking (CWE-427). The installer's uncontrolled DLL search path allows a crafted DLL placed in the same directory to be loaded when the installer runs, leading to arbitrary code execution with the privilege...

The vulnerability of the SAP GUI graphical user interface for Windows relates to deficiencies in the mechanism for calling system libraries, allowing attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the SAP GUI graphical user interface for Windows relates to deficiencies in the mechanism for calling system libraries. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a...

CVE-2026-78574 Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...

CVE-2026-77699

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

CVE-2026-77699

ManageEngine Endpoint Central (Zohocorp) versions below 11.5.2605.01 are susceptible to a local privilege escalation caused by loading a DLL from an untrusted path . An attacker with low-level local access and the ability to prompt a user for interaction could exploit this to gain elevated privil...

CVE-2026-77699 Privilege Escalation

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

CVE-2026-77699 Privilege Escalation

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

EUVD-2026-72337

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

PT-2026-86675

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

CVE-2026-77699: Improper Privilege Management

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

CVE-2026-9634

CVE-2026-9634 affects Rockwell Automation's Redundancy Module Configuration Tool (RMConfigTool.exe). The binary searches system path directories for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to incorrect default permissions. A l...