CVE-2022-0847-DirtyPipe-Exploit

CVE-2022-0847-DirtyPipe Vulnerability Overview On March 7, foreign security researcher Max Kellermann published a blog disclosing a local privilege escalation vulnerability CVE-2022-0847 in the Linux kernel: https://dirtypipe.cm4all.com/ CVE-2022-0847 is a local privilege escalation vulnerability...

CVE-2019-5736

Usage Edit HOST inside payload.c, compile with make. Start nc and run pwn.sh inside the container. Notes This exploit is destructive: it'll overwrite /usr/bin/docker-runc binary on the host with the payload. It'll also overwrite /bin/sh inside the container. Tested only on Debian 9. No attempts...

CVE-2022-21587-POC

CVE-2022-21587-POC- CVE-2022-21587 POC root@kitploit: file exploit.py will overwrite to file .pl not recommended for use, will affect the system file EBS not overwrite, will create a new shell file install slipit: git clone https://github.com/usdAG/slipit root@kitploit: cd slipit python3 setup.py...

CVE-2026-37068

CVE-2026-37068 Произвольная запись файла в /vfm-admin/index.php?section=translations&action=update в Veno File Manager Project 4.4.9 позволяет аутентифицированному пользователю с ролью суперадминистратора перезаписывать любой php-файл в приложении с помощью специально сформированного POST-запроса...

CVE-2026-5555-Container-Escape-via-proc-self-fd-Symlink-in-Shared-Volume

CVE-2026-5555 – /proc/self/fd 심볼릭 링크를 통한 컨테이너 탈출 개요 rshared 전파propagation로 마운트된 공유 볼륨은 악성 컨테이너가 /proc/self/fd를 통해 호스트 파일을 가리키는 심볼릭 링크를 생성할 수 있게 합니다. 볼륨에 쓰는 호스트 프로세스는 심볼릭 링크를 따라가며 중요한 호스트 파일을 덮어쓰고 컨테이너를 탈출할 수 있습니다. 취약점 세부 정보 유형: 컨테이너 탈출 / 심볼릭 링크 공격 영향: 호스트 파일 덮어쓰기, 호스트에서 루트 권한 상승. 근본 원인: 컨테이너 런타임이...

CVE-2020-0753-and-CVE-2020-0754

Writeup and POC for CVE-2020-0753, CVE-2020-0754 and six fixed Window DOS Vulnerabilities Exploit FileSystem race condition bug - analysis of CVE-2020-0753 and CVE-2020-0754 Windows Error Reporting service has fixed 2 Elevation of Privilege bugs in last Patch Tuesday, the two bugs are assigned wi...

CVE-2026-11784-Optimole-CSRF

CVE-2026-11784: CSRF to Arbitrary File Overwrite in Optimole WordPress Plugin Summary A Cross-Site Request Forgery CSRF vulnerability in the Optimole plugin for WordPress versions = 4.2.5 allows unauthenticated attackers to silently overwrite existing media library assets via the...

deepin-linux_reader_RCE-exploit

CVE-2023-50254 - Deepin Linux's default document viewer deepin-reader RCE CVE-2023-50254: PoC Exploit for Deepin-reader RCE that affects unpatched Deepin Linux Desktops. Deepin Linux's default document reader "deepin-reader" software suffers from a serious vulnerability due to a design flaw that...

CVE-2026-54337-PoC

CVE-2026-54337 PoC CVE-2026-54337 - Неаутентифицированная запись/перезапись файлов в fireshare = 1.16.3 PoC Для получения дополнительной информации обратитесь к этому уведомлению Github Настройка Пожалуйста, используйте следующий docker-compose.yml для тестирования root@kitploit: services:...

CVE-2022-0847-DirtyPipe-Exploits

CVE-2022-0847-DirtyPipe-Exploits A collection of exploits and documentation for penetration testers and red teamers that can be used to aid the exploitation of the Linux Dirty Pipe vulnerability. About The Vulnerability Dirty Pipe CVE-2022-0847 is a local privilege escalation vulnerability in the...

CVE-2022-0847-Container-Escape

CVE-2022-0847 CVE-2022-0847 used to achieve container escape overwrite any read-only files on host Slides in Chinese available here 利用CVE-2022-0847 Dirty Pipe 实现容器逃逸（效果为覆写宿主机上任意只读文件） 中文汇报PPT在这里 Introduction If the kernel is vulnerable to CVE-2022-0847, the attacker can overwrite read-only files...

GL.iNet <= 4.3.7 - Arbitrary File Write

GL.iNet = 4.3.7 is vulnerable to an arbitrary file write exploit, allowing an attacker to overwrite arbitrary system files. id: CVE-2023-46455 info: name: GL.iNet = 4.3.7 - Arbitrary File Write author: Zierax severity: high description: | GL.iNet = 4.3.7 is vulnerable to an arbitrary file write...

Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by...

shakeitoff

shakeitoff A smaller, minimized, and cleaner version of InstallerFileTakeOver aka the zero-day exploit that is a "variation" of CVE-2021-41379 later assigned CVE-2021-43883. This version does not pop a shell like InstallerFileTakeOver. The point of this code was to create a simpler proof of conce...

cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack

A flaw was found in the 'go bug' command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system's temporary directory could exploit this by creating a symbolic link symlink with one of these predictable...

Important: Red Hat Security Advisory: golang security update

An update for golang is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-14361

CVE-2026-14361 Consul Template의 writeToFile 헬퍼는 운영자가 지정한 대상을 직접 열고 연결된 경로 구성 요소를 따르므로, 렌더링된 출력이 의도된 디렉터리를 벗어나 기존 파일을 덮어쓸 수 있습니다. 소개 저는 HashiCorp Consul Template 을 검토하면서 다음과 같은 직접적인 파일시스템 보안 질문을 염두에 두고 이 문제를 발견했습니다: writeToFile이 의도된 디렉터리 안에 있는 것처럼 보이는 경로를 받으면, 파일시스템이 실제로 데이터를 기록할 위치를 검증합니까? 이 경우, ...

CVE-2025-24203-iOS-Exploit-With-Error-Logging

CVE-2025-24203 Эксплойт iOS 16.0 – 18.3.2 Thhe C-эксплойт CVE-2025-24203, нацеленный на iOS версии 16.0 – 18.3.2 на всех устройствах. Эксплойт от Ian Beer, я просто добавил улучшенное логирование ошибок и корректное завершение : Изначально обнаружен Ian Beer из Google Project Zero , я немного...

dirtypipez-exploit

CVE-2022-0847 DirtyPipe Exploit. Credit: Max Kellermann [email protected] A new Linux vulnerability known as 'Dirty Pipe' allows local users to gain root privileges through publicly available exploits. Today, security researcher Max Kellermann responsibly disclosed the 'Dirty Pipe'...

cve-2019-5736-poc

To run: 1. edit poc command in stage2.c 2. build docker docker build -t cve . 3. run docker docker run -d cve /bin/bash -c "tail -f /dev/null" 4. backup docker-runc cp /usr/bin/docker-runc /usr/bin/docker-runc.bak 5. docker exec -it docker-id /bin/bash 6. in docker run cd /root && ./run.sh && exi...