CVE-2025-4631

🚨 CVE-2025-4631 - Profitori WordPress Plugin Privilege Escalation Exploit 📌 Vulnerability Summary Profitori Plugin versions 2.0.6.0 to 2.1.1.3 is vulnerable to unauthenticated privilege escalation due to a missing capability check in the /wp-json/stocktend/v1/stocktendobject endpoint. This allows...

CVE-2022-35841

CVE-2022-35841 This is only a small writeup with the theory, as this bug was collided on and I never did get around to properly testing this. EnterpriseAppMgmtSvc is an interesting service implementing COM objects. Seems to date from Windows Phone and indeed, most of the COM interfaces implemente...

CVE-2026-0047-poc

CVE-2026-0047: Missing Permission Check in ActivityManagerService Heap of bitmaps stolen from every running app — zero permissions, zero user interaction. A missing enforceCallingOrSelfPermissionDUMP check in ActivityManagerService.dumpBitmapsProto allows any installed app to exfiltrate UI bitmap...

CVE-2023-26083

CVE-2023-26083 – Mali GPU Kernel Address Leak via Timeline Stream This repository contains a proof-of-concept PoC exploit for CVE-2023-26083 , a vulnerability in the Mali GPU driver Arm Mali GPU Kernel Driver that allows an unprivileged user to leak kernel pointers and sensitive internal...

CVE-2023-33477

CVE-2023-33477 Harmonic NSG 9000-6G modulator has an unauthorized download vulnerability in the config.exp configuration file Due to the lack of access permission verification for the "cgi.bin/config.exp" file in this model modulator, any user may request to download a configuration file while...

CVE-2024-10586

CVE-2024-10586 Debug Tool = 2.2 - Unauthenticated Arbitrary File Creation Description: The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbtpullimage function and missing file type validation in all versions up to, and including,...

CVE-2023-33246

CVE-2023-33246 - RocketMQ Remote Code Execution CVE-2023-33246 - Apache RocketMQ config Remote Code Execution Exploit Overview RocketMQ is a distributed messaging and streaming platform. RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is...

CVE-2024-4875

CVE-2024-4875 HT Mega – Absolute Addons For Elementor = 2.5.2 - Missing Authorization to Options Update Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the...

CVE-2023-47179

CVE-2023-47179 WooODT Lite = 2.4.6 - Missing Authorization to Arbitrary Options Update Subscriber+ Description: The WooODT Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the byconsolewooodtadminfieldssettingfiles function hooked v...

CVE-2026-0092

CVE-2026-0092 在包管理器中，由于缺少权限检查，可能存在设备锁控制器绕过的问题。这可能导致本地权限提升，且无需额外的执行权限。利用该漏洞无需用户交互。 NVD - CVE-2026-0092 Android 安全公告 - Android 17...

DEBIAN-CVE-2026-90227

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...

nifi-CVE-2026-39816-poc

Apache NiFi CVE-2026-39816 POC Demostración de prueba de concepto para CVE-2026-39816, una omisión del permiso EXECUTECODE en Apache NiFi 2.8.0 que permite a un diseñador de flujos al que se le han denegado deliberadamente los privilegios de ejecución de código ejecutar Groovy arbitrario en la JV...

velociraptor_CVE-2025-6264_PoC

CVE-2025-6264 DISCLAIMER: This is an educational research project. I did not discover this vulnerability. This repository demonstrates CVE-2025-6264 for learning purposes Affected versions before 0.74.3 Affects Windows, MacOS and Linux The Admin.Client.UpdateClientConfig artifact is missing...

EUVD-2026-80079

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

CVE-2026-18426

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

EUVD-2026-79942

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

CVE-2026-58726

In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-57012

In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56970

In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56982

In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...