S4UTomato

S4UTomato Escalate Service Account To LocalSystem via Kerberos. Traditional Potatoes Friends familiar with the "Potato" series of privilege escalation should know that it can elevate service account privileges to local system privileges. The early exploitation techniques of "Potato" are almost...

CVE-2026-28326-check

SolarWinds Access Rights Manager Unauthenticated RCE — Vulnerability Detection Script An unauthenticated patch-state check for CVE-2026-28326, the unauthenticated remote code execution vulnerability in SolarWinds Access Rights Manager ARM, fixed in ARM 2026.2.1 on 2026-09-17. CWE-798, CVSS 8.8 Hi...

CVE-2026-85884

WPAD LPAC / WHESVC privilege escalation https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85884 This repository contains research and proof-of-concept material for a Windows privilege-boundary issue involving the Windows Health and Optimized Experiences service whesvc and the Windows...

CVE-2025-14018

CVE-2025-14018: NetBT e-Fatura Privilege Escalation Vulnerability 📋 General Information Parameter| Value ---|--- CVE ID| CVE-2025-14018 Vulnerability Type| Local Privilege Escalation Unquoted Service Path CWE| CWE-428 Affected Product| NetBT e-Fatura Vulnerable Versions| 1.2.15 Exploit Author|...

CVE-2025-47962-POC

CVE-2025-47962-POC Reproduction process： i686-w64-mingw32-gcc -shared -o CRYPTBASE.dll poc.c -lkernel32 copy CRYPTBASE.dll "C:\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\CRYPTBASE.dll" net stop IpOverUsbSvc net start IpOverUsbSvc Explanation： IpOverUsbSvc sc.exe qc IpOverUsbSvc SERVICENAME:...

CVE-2022-23909

CVE-2022-23909 Description: On Windows, the Sherpa Connector Service version 2020.2.20328.2050 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. In case of a poorly...

CVE-2026-126612

Progressive Robot hMailServer versions 6.0.0 through 6.3.7 are vulnerable to Improper Link Resolution Before File Access (CWE-59) in the Windows installer. A local authenticated user can execute arbitrary code as the mail server's service account (LocalSystem or virtual account) or as an administ...

CVE-2026-126612 Improper Link Resolution Before File Access ('Link Following') in hMailServer

Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a moun...

CVE-2026-126607

Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the folder of its authentication plugins the plugin folder in the installation's Bin folder as Latin-1 bytes, which the client reads in the system's ANSI code page...

CVE-2024-27462

CVE-2024-27462 Wondershare MobileTrans 4.5.6 - Unquoted Service Path Description: Wondershare Filmora versions 4.5.6 and lower contain multiple unquoted service path which allow attackers to escalate privileges to the system level. Impacted services WsAppService3 service binary Path C:\Program...

EUVD-2026-113416

A vulnerability allowing an authenticated domain user to perform remote code execution RCE as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service...

EUVD-2026-113417

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem...

CVE-2026-92744

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem...

CVE-2026-107238

A vulnerability allowing an authenticated domain user to perform remote code execution RCE as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service...

CVE-2026-92744 Delinea Privilege Manager agent unauthenticated remote code execution vulnerability

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem...

CVE-2026-92744 Delinea Privilege Manager agent unauthenticated remote code execution vulnerability

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem...

CVE-2026-92744

The Delinea Privilege Manager agent is vulnerable to a remote code execution (RCE) flaw. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability to execute arbitrary code with LocalSystem privileges. The vulnerability is associated with CWE-306 (Missing Authent...

CVE-2026-107238

A vulnerability in the Veeam Management Pack for Microsoft System Center Collector service allows an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account . This flaw was identified during internal testing and impacts Veeam Management Pack for Microsoft Syste...

CVE-2026-107238

A vulnerability allowing an authenticated domain user to perform remote code execution RCE as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service...

CVE-2026-107238

A vulnerability allowing an authenticated domain user to perform remote code execution RCE as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service...