moukthar

Moukthar 안드로이드용 원격 관리 도구 데모 기능 권한 우회 안드로이드 12 이하 키로거 알림 리스너 SMS 리스너 통화 녹음 이미지 캡처 및 스크린샷 비디오 녹화 지속성 연락처 읽기 및 쓰기 설치된 애플리케이션 목록 파일 다운로드 및 업로드 기기 위치 확인 설치 리포지토리 클론 root@kitploit: git clone https://github.com/Tomiwa-Ot/moukthar.git PHP, Composer, MySQL, php-mysql 드라이버, Apache2, a2enmod 설치 서버 파일을...

CVE-2026-26012

CVE-2026-26012 - 概念実証（PoC） 認証済み組織コレクション権限バイパス＆暗号列挙（Vaultwarden） NVDリファレンス: CVE-2026-26012...

CVE-2026-76081

ZITADEL , an open source identity management platform, contains a permission revocation flaw affecting versions prior to 4.16.0 . When multiple project roles are deleted simultaneously, a bug in the permission-update logic can cause some User Grants on Granted Projects (projects shared between or...

CVE-2026-84601

CVE-2026-84601 is a permissions issue in the Apple Intelligence component of macOS , addressed with improved state management. The vulnerability allows an app to bypass Apple Intelligence security prompts , resulting in a high integrity impact with no confidentiality or availability impact (CVSS ...

CVE-2026-84601: Incorrect Authorization

A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Apple Intelligence security prompts...

CVE-2026-19583 Velociraptor Required Permissions bypass by using client monitoring queries

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...

CVE-2026-19583 Velociraptor Required Permissions bypass by using client monitoring queries

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...

CVE-2026-19583 Velociraptor Required Permissions bypass by using client monitoring queries

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...

CLEANSTART-2026-KP10631 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the vault-k8s package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for...

CVE-2026-49887

In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28620

In multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28622

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49887

In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-74009

In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49887

In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49887

In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73969

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28622

A permissions bypass vulnerability exists in the getQueryBuilderInternal method of MediaProvider.java within the Media Provider component. This flaw allows an attacker to retrieve location metadata , potentially resulting in local information disclosure . The vulnerability requires no additional ...

CVE-2026-28622

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28622

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...