CVE-2025-9267

CVE-2025-9267 Description In Seagate Toolkit on Windows there is an insecure DLL-loading vulnerability in the Toolkit Installer prior to version 2.35.0.6 where the installer attempts to load DLLs from the current working directory without validating their origin or integrity. An attacker who can...

CVE-2025-60749

CVE-2025-60749 SketchUp Desktop 2025 DLL Hijacking Vulnerability...

CVE-2026-21508_POC

Proof-of-concept for CVE-2026-21508 For more information see: https://0xc4r.github.io/posts/CVE-2026-21508 Descrption: Proof-of-concept consist in a simple batch script and a DLL project: The DLL will be used to perform the DLL hijacking attack and will mainly perform the following actions when...

CS-DropSpawn_BOF

DropSpawn Introduction DropSpawn is a CobaltStrike BOF used to spawn additional Beacons via a relatively unknown method of DLL hijacking. Works x86-x86, x64-x64, and x86-x64/vice versa. Use as an alternative to process injection. Windows executables will follow the DLL search order when trying to...

IOBitMalwareFighterDLL

Malware Fighter LPE 0 day LPE I found in IObit Malware Fighter v. 13.2.0. Writup: https://nathan2.com/files/iobit.pdf Overall info: https://nathan2.com/posts/iobit/ Compile the DLL as x86 and name it Register.dll. Then place it in your system's Path. By default that is...

KINGSOFT-WPS-Office-LPE

JVN Advisory https://jvn.jp/en/vu/JVNVU90673830/ The following CVE number have been assigned: CVE-2022-25943 KINGSOFT WPS Office LPE WPS Office is an office suite for Microsoft Windows, macOS, Linux, iOS, Android, and HarmonyOS developed by Zhuhai-based Chinese software developer Kingsoft...

CVE-2019-0887

CVE-2019-0887 Compile the CVE-2019-0887, rename to winhlp.dll Compile the InstallHook, rename to hook.exe be careful, they must be compile with x64 Put then into the evil system just like that root@kitploit: c:\windows\hook.exe c:\windows\winhlp.dll c:\windows\winhlp64.exe something evil if...

qlikview-poc-CVE-2024-29863

Affected application: QlikView Platform: Windows Issue: Local Privilege Escalation via MSI installer DLL hijacking race condition Discovered and reported by: Pawel Karwowski and Julian Horoszkiewicz Eviden Red Team Details: On systems with QuikView12 installed, it is possible for regular users to...

Enumprotections_BOF

Enumprotections BOF This BOF can be used to enumerate system processes and identify the protection level of each one. Additional information, like service relation, user, session, and path, are also returned. This information in combination can be used to identify good candidates to explore for...

CVE-2025-47962-POC

CVE-2025-47962-POC Proceso de reproducción: i686-w64-mingw32-gcc -shared -o CRYPTBASE.dll poc.c -lkernel32 copy CRYPTBASE.dll "C:\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\CRYPTBASE.dll" net stop IpOverUsbSvc net start IpOverUsbSvc Explicación: IpOverUsbSvc root@kitploit: sc.exe qc IpOverUsbS...

chimera

Rust-based DLL hijacking loader for MobaXterm CVE-2026-6421 with persistence...

wptsextensions.dll

WptsExtensions.dll for exploiting Task Scheduler DLL Hijacking "won't fix " Load x64 visual studio environnement variables: root@kitploit: "C:\Program Files x86\Microsoft Visual Studio\2019\Community\VC\Auxiliary\Build\vcvars64.bat" Update the TCHAR script variable with a writable SYSTEM path whe...

CdpSvcLPE

CdpSvcLPE Windows Local Privilege Escalation via CdpSvc service Writeable SYSTEM path Dll Hijacking Short Description: Connected Devices Platform Service or CDPSvc is a service which runs as NT AUTHORITY\LOCAL SERVICE and tries to load the missing cdpsgshims.dll DLL on startup with a call to...

IDiagnosticProfileUAC

IDiagnosticProfileUAC Just another UAC bypass using auto-elevated COM object Virtual Factory for DiagCpl 12C21EA7-2EB8-4B55-9249-AC243DA8C666. This COM object can be used to create instance of DiagnosticProfile D0B7E02C-E1A3-11DC-81FF-001185AE5E76 COM object which exposes SaveDirectoryAsCab metho...

Zoom-dll-hijacking

Zoom-dll-hijacking A dll hijacking vulnerability in zoom meeting 5.1.3 Affected Windows version Windows 7 or less Windows Server 2008 Any other windows system that doesn't have SHCore.dll present. Usage Copy the dbghelper.dll and SHCore.dll to following location...

CVE-2026-9634

A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loca...

CVE-2026-9633

A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loc...

CVE-2026-9634 Redundancy Module Configuration Tool - Multiple Vulnerabilities

A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loca...

EUVD-2026-69148

A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loca...

CVE-2026-9633

CVE-2026-9633 affects Rockwell Automation's Redundancy Module Configuration Tool . The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, but due to incorrect default permissions , one or more of these directories may be writable by standard (non-administrator) u...