CVE-2023-26818

Disclaimer This exploit has been created solely for the purposes of research and for the development of effective defensive techniques. It is not intended to be used for any malicious or unauthorized activities. The author and the owner of the script disclaim any responsibility or liability for a...

CVE-2024-6778-POC

CVE-2024-5836 / CVE-2024-6778 This repository contains proof of concept exploits for CVE-2024-5836 and CVE-2024-6778, which are vulnerabilities within the Chromium web browser which allowed for a sandbox escape from a browser extension. To run these, you must be on a version of Chromium older tha...

CVE-2022-0543

CVE-2022-0543 Fully featured exploit for Redis RCE through Lua Sandbox Escape vulnerability. Based on https://thesecmaster.com/how-to-fix-cve-2022-0543-a-critical-lua-sandbox-escape-vulnerability-in-redis/. Features: Automatic reverse shell -I + -P Single command execution -x Basic shell Default ...

jailbreak-iOS12

Jailbreak for iOS 12 iOS 12.0 & 12.1.2 Jailbreak with CVE-2019-6225 An incomplete iOS 12 Jailbreak. For now it only runs the exploit, gets tfp0, gets ROOT, escapes the SandBox, writes a test file to prove the sandbox was escaped then resprings. Feel free to build on top of it as long as you respe...

CVE-2019-0808

CVE-2019-5786 and CVE-2019-0808 Chrome 72.0.3626.119 stable Windows 7 x86 exploit chain. This exploit uses site-isolation to brute-force CVE-2019-5786. host1wrapper/iframe.html is the wrapper script that loads the exploit repeatedly into an iframe. The actual chain resides in the host2singlerun...

bluetoothdPoC

@RaniXCH bluetoothdPoC CVE-2018-4087 PoC ETA son? Is it a jailbreak? Depends, Got any kernel vulnerability? You're welcome chain them together. This one allow you to have huge attack surface from within the sandbox. https://www.weibo.com/ttarticle/p/show?id=2309404271293301154324 - @SparkZheng -...

CVE-2026-5061

CVE-2026-5061 Consul Template validated where a symlink pointed during template evaluation, but its later dependency fetch read the original path. Retargeting the link between those operations turned an in-sandbox file reference into an out-of-sandbox file disclosure. Intro I found this issue whi...

CVE-2022-30292

CVE-2022-30292 Description This vulnerability is the heap-based buffer overflow in the function threadcall in Squirrel 3.2 and below. It caused by the lack of the call of sqreservestack function. This vulnerability leads to DoS of the client and could possibly lead to sandbox escape and arbitrary...

CVE-2026-6875-PoC-Exploit

CVE-2026-6875 - ServiceNow Pre‑Auth RCE Exploit Framework & PoC Verifier ServiceNow AI Platform — JavaScript Injection → Sandbox Escape → RCE → Root Privesc Exploit Framework & Safe Verifier For authorized security testing only. Legal Disclaimer & Responsible Use This tool is provided for...

CVE-2022-22715

Blogpost: https://whereisk0shl.top/post/break-me-out-of-sandbox-in-old-pipe-cve-2022-22715-windows-dirty-pipe Exploit needs to be executed from LOW INTEGRITY Cleanup is not completed. The exploit just fix the overwritten TOKEN objects but not the VS pool structure. This part is explained in the...

CVE-2020-0041

CVE-2020-0041 This repository contains code for exploiting CVE-2020-0041, a bug we reported to Google in Decmeber 2019 and was fixed in the Android Security Bulletin from March 2020. You can find the sandbox escape exploit in sandbox/. The analysis of the bug and exploitation approach can be foun...

DoubleStar

. . \ \ \ | | | / // | | | \ / \ | | | \ | | / \ \ \ \ \ \ \ \ | \ | | /| \ | |\ / / \ | | / | | / / / / |/ | /|/ \ / / || /|| / / / / / Windows 8.1 IE/Firefox RCE - Sandbox Escape - SYSTEM EoP Exploit Chain | Remote PAC | || ^ | HTTPS RPC/ALPC RPC/ALPC | firefox.exe | ---------- |...

CVE-2024-54152

⚙️🔨 IN PROGRESS CVE-2024-54152 POC Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex undisclose...

WPTaskScheduler_CVE-2024-49039

WPTaskScheduler Persistence & CVE-2024-49039, as one of Attack Surface within Task Scheduler. WPTaskScheduler.dll is a component of Task Scheduler, since win 10 1507. This is likely a backdoor tool used for persistence, which was analyzed by security researchers, who found that able to bypass...

CVE-2024-32462

CVE-2024-32462 CVE-2024-32462 code exec sbx escape How the directory should look to compile this ├── org.exploit.SandboxEscape.yaml ├── exploit.py └── app/ └── exploit.desktop How to run & build 1.Install Flatpak SDK if needed: flatpak install flathub org.freedesktop.Platform//21.08 flatpak insta...

CVE-2023-28229

CVE-2023-28229 Windows CNG KeyIso RPC EoP/SBX Discovered by: @k0shl Reference: https://whereisk0shl.top/post/isolate-me-from-sandbox-explore-elevation-of-privilege-of-cng-key-isolation If compilation fails, rename rpc.h to something else because I didn't realise rpc.h is a standard include in...

brokentooth

brokentooth POC for CVE-2018-4327 at least I think so since CVE-2018-4327 and CVE-2018-4330 were both discussed by @SparkZheng but it's not clear from him which one relates to which bug but since he described this one first I'm taking a guess. Tested on iPhone 6S 11.3.1 Should work until 11.4 Let...

Exploits

This repository contains a personal collection of Windows CVE I have turned in to exploit source, as well as a collection of payloads I've written to be used in conjunction with these exploits. Some of these CVE have been joined together in exploit chains for RCE, sandbox escapes and privilege...

IE11SandboxEscapes

IE11SandboxEscapes Some example source code for fixed IE11 sandbox escapes. c James Forshaw 2014 For information purposes only. All files are licensed under GPLv3. See LICENSE for more information...

CVE-2022-0543

CVE-2022-0543 CVE-2022-0543RCE,Redis Lua沙盒绕过 命令执行 Usage python3 CVE-2022-0543.py...