CVE-2020-1066-EXP

Reference This vulnerability belongs to the Windows CardSpace service that does not properly handle symbolic link objects, leading to a local privilege escalation via arbitrary file replacement. Disclaimer The author's PoC is for research purposes only. If readers use this PoC for other activitie...

CVE-2023-36723

CVE-2023-36723 This is PoC for arbitrary directory creation bug in Container Manager service. This PoC is not thoroughly tested so it may not even work most of the time it was enough for msrc to confirm vulnerability. In order to exploit this vulnerability a Windows Sandbox feature have to be...

colabcat

Colabcat Run Hashcat on Google Colab with session restore capabilities with Google Drive. Usage Go to the link below to open a copy of the colabcat.ipynb file in Google Colab: https://colab.research.google.com/github/someshkar/colabcat/blob/master/colabcat.ipynb Click on Runtime, Change runtime...

CVE-2026-53694-NoMachine-LPE

CVE-2026-53694: NoMachine Local Privilege Escalation via Argument Injection Overview This repository contains the write-up and Proof of Concept PoC for CVE-2026-53694, a Local Privilege Escalation LPE vulnerability in NoMachine for Linux. Due to improper neutralization of argument delimiters in t...

CVE-2026-89039

A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...

CVE-2026-89039

The k6 MCP server is vulnerable to a path traversal flaw in the convert_playwright_script prompt via the playwright_script argument. While @-prefixed paths are restricted to the current working directory, bare paths follow an undocumented code path with no restrictions, allowing callers to read a...

CVE-2026-89039 Arbitrary file read via the convert_playwright_script prompt in mcp-k6

A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...

EUVD-2026-92434

The convertplaywrightscript prompt in the k6 MCP server accepts a file path as its playwrightscript argument. Paths given in the documented '@'-prefixed form are restricted to the server's current working directory, but a bare path is resolved by a separate undocumented code path that applies no...

CVE-2025-11001

Usage: python3 exploit.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe Exploiting 7-zip The vulnerability is only exploitable on windows and has one major caveat.The bug can only be exploited when 7-Zip is ran with Admin privileges for this vulnerability to be succesfully exploited...

SEP-14.2-Arbitrary-Write

Exploit CVE-2020-5837 El análisis se puede encontrar en el blog de RedyOps Labs: https://labs.redyops.com/index.php/2020/04/27/symantec-endpoint-protection-sep-14-2-eop-via-arbitrary-write/ Herramientas de Terceros Este código de exploit se basa en gran medida en symboliclink-testing-tools, que f...

CVE-2021-26415

PoC Quick PoC for CVE-2021-26415 as described on https://www.cloaked.pl/2021/04/cve-2021-26415/ The BaitAndSwitch.exe is compiled from https://github.com/googleprojectzero/symboliclink-testing-tools/tree/master/BaitAndSwitch...

CVE-2023-23946-POC

CVE-2023-23946 POC Exploit Explanation and POC of the CVE-2023-23946 The CVE-2023-23946 vulnerability is caused by a flaw in the way git handles symbolic links. When git creates a symbolic link, it doesnt actually handle it as a symbolic link and because of that we can exploit it to point to file...

CVE-2025-48799

Description This is PoC for CVE-2025-48799, an elevation of privilege vulnerability in Windows Update service. This vulnability affects windows clients win11/win10 with at least 2 hard drives. When machine have multiple hard drives it is possible to change location where new content is saved usin...

CVE-2025-31133

CVE-2025-31133 PoC Exploit This document explains the functionality of the provided Proof-of-Concept PoC script for the runc vulnerability CVE-2025-31133. Summary Vulnerability: CVE-2025-31133 - A symbolic link race condition in runc's maskedPaths handling. Impact: A malicious container can bypas...

git_rce

CVE-2024-32002 PoC 1. You must set up the git's symbolic link option like: git config --global core.symlinks true 2. Then exploit CVE-2024-32002 by the following command: git clone --recursive https://github.com/EQSTSeminar/gitrce.git Attack Scenario kali192.168.216.129 --Give remote repository...

CVE-2024-2432-PaloAlto-GlobalProtect-EoP

CVE-2024-2432 Palo Alto GlobalProtect EoP On Windows system, it was found that GlobalProtect App version 6.1.1-5 and 6.2.0-89 was vulnerable to arbitrary file delete with elevated privileges by symbolic link attack lead to local privilege escalation on local machine. It was observed that when a...

CVE-2024-38819-POC2

CVE-2024-38819: Proof of Concept PoC This is a proof of concept for the CVE-2024-38819 vulnerability, which I reported, demonstrating a path traversal exploit. Execution Steps 1. Build the Docker image Spring Boot 3.3.4, based on Spring Framework 6.1.13 cd vuln docker build -t cve-2024-38819-poc...

CVE-2021-21300

CVE-2021-21300 In multiple versions of git, the handling of symbolic links is not strict. After uploading files to git on a case-sensitive file system e.g., Linux, cloning a malicious repository on a host using a case-insensitive file system e.g., Windows may lead to remote command execution...

CVE-2015-1769

CVE-2015-1769 PoC for CVE-2015-1769 VHD file to reproduce CVE-2015-1769. VHD doesn't contain actual payload only notepad.exe. Upon mounting inspect system log for reported blocked error if latest patch is installed. Batch script shows how symbolic link was created that triggers the vulnerability...

CVE-2025-48799

Description This is PoC for CVE-2025-48799, an elevation of privilege vulnerability in Windows Update service. This vulnability affects windows clients win11/win10 with at least 2 hard drives. When machine have multiple hard drives it is possible to change location where new content is saved usin...