Reaper

「💀」 Sobre Reaper Reaper es una prueba de concepto diseñada para explotar la vulnerabilidad del controlador BYOVD Bring Your Own Vulnerable Driver. Esta técnica maliciosa implica insertar un controlador legítimo y vulnerable en un sistema objetivo, lo que permite a los atacantes explotar el...

zBang

zBang es una herramienta especial de evaluación de riesgos que detecta posibles amenazas de cuentas privilegiadas en la red escaneada. Las organizaciones y los equipos rojos pueden utilizar zBang para identificar posibles vectores de ataque y mejorar la postura de seguridad de la red. Los...

ACLight

ACLight Una herramienta para el descubrimiento avanzado de Cuentas Privilegiadas - incluyendo Shadow Admins. ACLight2 es la versión mejorada de la herramienta. Investigación de Shadow Admins La herramienta versión 1 se publicó como parte de la investigación "Shadow Admins" - más detalles sobre...

CheeseTools

CheeseTools Este repositorio se ha creado basándose en el ya existente MiscTool, así que un gran agradecimiento a rasta-mouse por publicarlos y darme la motivación adecuada para trabajar en ellos. CheeseExec Ejecución de comandos / Movimiento lateral mediante funcionalidad similar a PsExec. Debe...

CVE-2023-20511

CVE-2023-20511 affects the AMD kernel mode driver (KMD) , where an invalid pointer release can create a double free condition. A privileged attacker with network access and high attack complexity could potentially exploit this to achieve arbitrary code execution . The CVSS v3.1 score is 6.4 (Medi...

EUVD-2023-60609

Release of an invalid pointer in the AMD kernel mode driver KMD could allow a privileged attacker to create a double free condition potentially leading to arbitrary code execution...

CVE-2026-51153

Stored Cross-Site Scripting XSS in TaskRunHandler.post in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task//run, the handler renders task log content logtmp into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from th...

vault

Vault Please note : We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at [email protected]. Website: developer.hashicorp.com/vault Announcement list: Google Groups Discussion...

CVE-2026-78078

Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate 2.2.10 - Image uploads previously validated only file extension and basic size parameters. Non-image files disguised with raster extensions could be uploaded. Added strict MIME verification an...

CVE-2021-31762

CSRF-to-RCE ..| CVE-2021-31762 |.. Descripción : Explotando un ataque de falsificación de petición en sitios cruzados CSRF para crear un usuario privilegiado a través de la función de añadir usuarios de Webmin y luego obtener una shell inversa a través de la función de procesos en ejecución de...

CVE-2021-44967

CVE-2021-44967 - Authenticatedprivileged RCE Authenticated privileged remote command execution in LimeSurvey Version 5.2.4 via upload and install plugins allows a remote user to upload arbitrary PHP code file. Usage python3 exploit.py --url --user --password --lhost --lport A superadmin user is...

CVE-2024-11467

CVE-2024-11467 The macOS operating system uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools. The VMware Horizon Client, upon installation, registers the...

botb

Break out the Box BOtB BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies. What does it do? BOtB is a CLI tool which allows you to: Exploit common container vulnerabilities Perform commo...

cve-2025-9074-poc

CVE-2025-9074 Educational PoC / Proof of Concept Code This repository contains a PoC for educational purposes that demonstrates the risk of exploiting Docker Engine's unauthenticated remote API to create a privileged container with read/write access to the host filesystem. The executable file is...

CVE-2024-3183-POC

CVE-2024-3183-POC POC for CVE-2024-3183 FreeIPA Rosting Impact: A low-privileged user can obtain a hash of the passwords of all domain users and perform offline brute force kerberoasting. Patch impacket-getTGT: 1. Add decoder.decode.defaultErrorState = stGetValueDecoderByTag to...

vulnerable-container-hub

The OWASP Vulnerable Container Hub Project Background There are many repositories out there to provide vulnerable environments such as web applications, containers or virtual machines to those who want to learn security, since it helps not only students or someone who recently joined the field to...

W&B Weave Server - Remote Arbitrary File Leak

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin. id:...

Klog Server <=2.41 - Unauthenticated Command Injection

Klog Server 2.4.1 and prior is susceptible to an unauthenticated command injection vulnerability. The authenticate.php file uses the user HTTP POST parameter in a call to the shellexec PHP function without appropriate input validation, allowing arbitrary command execution as the apache user. The...

CVE-2025-9074

CVE-2025-9074: Docker Engine API の認証なし RCE 重要度 : CRITICAL | CVSS スコア : 9.8 推定 | 影響を受けるバージョン : Docker Desktop 4.44.3 CVE-2025-9074 の概念実証エクスプロイトです。これは Docker Engine API における認証なしのリモートコード実行 RCE 脆弱性であり、特権コンテナのエスケープとホストシステムの侵害を可能にします。 🔴 脆弱性の概要 CVE-2025-9074 は Docker Desktop の深刻な脆弱性であり、適切な認証やネットワーク分離なしに...

CVE-2026-34213

CVE-2026-34213 Un usuario de Docmost con pocos privilegios podría proporcionar un attachmentId de una víctima al endpoint de carga genérico y sobrescribir el archivo adjunto de otra página dentro del mismo espacio de trabajo. Introducción Identifiqué, divulgué responsablemente y reproduje una fal...