CVE-2026-92369

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer,...

CVE-2026-92369

TeamViewer Full Client and Host on Windows prior to version 15.82 are vulnerable to a TOCTOU race condition within the installer rollback mechanism. A local low-privileged attacker can exploit this by replacing rollback backup files in a user-writable temporary directory before an elevated instal...

CVE-2026-92369 Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer,...

EUVD-2026-89020

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer,...

CVE-2026-92369 Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer,...

CVE-2026-19743 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges NT AUTHORITY/SYSTEM \ root. By sending crafted I...

CVE-2026-57239

Foxit PDF Reader LPE 针对 CVE-2026-3775/CVE-2026-3780 和 CVE-2026-57239 的概念验证漏洞利用程序，可通过 Foxit PDF Reader 更新服务获取 NT AUTHORITY\SYSTEM 权限。 构建 直接编译二进制文件，将其放到目标系统上并运行即可。 cargo build --release 用法 该程序有三个主要入口点：check、exploit 和 cleanup。参数的作用应该很清楚。默认情况下，exploit 之后会自动调用 cleanup，但如果某些进程仍持有打开句柄，你可能需要之后将此命令单独运行。...

CVE-2025-53136

CVE-2025-53136 Divulgación de información del kernel a través de condición de carrera . https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43511 https://www.crowdfense.com/nt-os-kernel-information-disclosure-vulnerability-cve-2025-53136/...

CVE-2019-1388

CVE-2019-1388 CVE-2019-1388 利用UAC Windows证书对话框 描述： 该CVE漏洞利用旨在滥用UAC Windows证书对话框，以NT Authority用户身份执行证书颁发者链接，并打开一个处于NT Authority用户下的浏览器。然后我们可以利用该浏览器以NT Authority用户身份启动一个shell。 步骤： 1 找到一个可以触发UAC提示屏幕的程序 2 选择“显示更多详细信息” 3 选择“显示发布者证书的相关信息” 4 点击“颁发者”URL链接，它将弹出一个浏览器界面。 5...

Geutebrueck_GCore_X64_RCE_BO

GeutebrueckGCoreX64RCEBO Módulo de Metasploit para el sistema de "gestión de video" Geutebrueck GCore. Probado con las versiones 1.3.8.42 y 1.4.2.37. Ejecución remota de código completa con privilegios de NT/System en Windows Win 2012R2, Win8.1, ... con los productos Geutebrueck instalados GCore...

CVE-2022-24483

CVE-2022-24483 CVE-2022-24483 的 POC "nt!PfpPrivSourceEnum" 函数中的一个信息泄露漏洞。 可靠性：高。...

CouchPotato

CouchPotato Asegúrate de compilar por tu cuenta para evitar la detección.. ciertas cadenas se codifican con XOR en tiempo de compilación.. no publicaré más binarios. Uso: CouchPotato.exe ip puerto Parchea ETW y AMSI y utiliza syscall indirecto para abusar de SeImpersonatePrivilege. Cuenta de...

CVE-2020-5752

CVE-2020-5752: Druva inSync 本地权限提升 一个基于C的漏洞利用程序，针对Druva inSync Windows客户端（v6.6.3及以下版本） 。该应用程序在端口6064上暴露了一个RPC服务，该服务存在通过路径遍历导致的命令注入漏洞。这使得本地用户可以以NT AUTHORITY\SYSTEM权限执行任意命令。 漏洞详情 CVE: 2020-5752 测试环境: Windows 10 x64 权限级别: 本地权限提升 LPE 用法 1. 编译 使用gcc（MinGW）编译源代码： gcc exploit.c -o exploit.exe -lws232 2...

TinyProcessor

TinyProcessor Este proyecto reemplaza los números de syscall y los argumentos en la salida .tag de Tinytracer con sus declaraciones reales de funciones Nt para una mejor legibilidad. Tenga en cuenta que algunas declaraciones de funciones no están incluidas, por lo que algunos argumentos no se...

UnhookingPatch

UnhookingPatch Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime image How do i convert binary to MAC ? Requirements: 1. macaddress pip install macaddress ./bin2mac.py calc.bin...

Shinigami

Shinigami Shinigami es una herramienta experimental diseñada para detectar y desempaquetar implantes de malware que se inyectan mediante process hollowing o rutinas genéricas de empaquetado. Cómo funciona La herramienta opera enganchando hooking funciones NT relacionadas con Process Hollowing y...

CVE-2026-79153

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-79153: Improper Privilege Management

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-79153

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-92378

A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing conditions during Service Offline Emergency Mode, a previously authenticated session may be retained after logout, which could allow a subsequent user to be...