CVE-2025-27591

CVE-2025-27591 description Basically below tool allow for universal modification on its log file which lead to privilege escalation as root. details. The log file created by below is world-writable, allowing any user to modify or replace it. An attacker can exploit this by creating a symbolic lin...

CVE-2023-40028

CVE-2023-40028 Proof of Concept This repository contains a proof of concept POC for CVE-2023-40028, demonstrating a vulnerability in the Ghost content management system where authenticated users can upload symlinks, leading to arbitrary file read vulnerabilities. Disclaimer This POC is provided f...

CVE-2025-8110-gogs-poc

CVE-2025-8110 — Gogs Arbitrary File Write PoC Proof-of-concept for an authenticated arbitrary file write in Gogs. By pushing a repository that contains a symbolic link pointing outside the repo and then updating that link's contents through the API, an authenticated user can overwrite files on th...

git_rce

CVE-2024-32002: git clone を介した Git RCE の悪用 このリポジトリは、git clone 操作中に RCE を可能にする Git の脆弱性 CVE-2024-32002 を悪用するための PoC を含んでいます。特定の方法でサブモジュールを持つリポジトリを作成することにより、攻撃者は大文字小文字を区別しないファイルシステム上のシンボリックリンク処理を悪用して .git/ ディレクトリにファイルを書き込み、悪意のあるフックの実行につなげることができます。 注意: この PoC は Windows または Mac システムでのみ動作します。 ブログ記事...

RegPwnBOF

RegPwn BOF Adaptación BOF de Cobalt Strike del exploit RegPwn por Filip Dragovic @Wh04m1001 / MDSec ActiveBreach. Esta es una reimplementación BOF descuidada del exploit original en C. Todo el crédito por la investigación de la vulnerabilidad y el exploit pertenece a Filip Dragovic y MDSec...

CVE-2025-55188

CVE-2025-55188: 7-Zip Arbitrary File Write Proof-of-concept of CVE-2025-55188, an arbitrary file write in 7-Zip. Patched in version 25.01, released on August 3, 2025. Note: CVE-2025-55188 is different than CVE-2025-11001. The version that CVE-2025-11001 was patched in version 25.00 is still...

cve-2024-32002-poc-rce

CVE-2024-32002 RCE POC A POC for CVE-2024-32002 demonstrating Remote Code Execution RCE. See cve-2024-32002-poc-rce for the related submodule repository. What this repo contains A symlink with an arbitraty name that links to the .git directory. A .gitmodules file that defines the malicious...

CVE-2025-27591-below-

CVE-2025-27591 – Privilege Escalation in Below 1 Introduction Below is a Linux tool for recording and displaying system data such as hardware utilization and cgroup metrics. In versions prior to v0.9.0 , Below’s systemd service runs with root privileges and creates world-writable log directories...

CVE-2025-24104

CVE-2025-24104 Writeup: Reading Files Out-of-Sandbox I reported a bug that Apple later tracked as CVE-2025-24104. In my original report, I demonstrated how a malicious backup could be used to bypass sandbox restrictions. However, Apple’s initial description stated that this vulnerability could le...

CVE-2026-82427

Description A topology's topology.blobstore.map lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both AsyncLocalizer and Container.createBlobstoreLinks, and the...

CVE-2026-82429

Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...

CVE-2026-57129

PraisonAI (praisonaiagents Python package) is vulnerable to arbitrary file read via the MentionsParser._process_file_mention function in mentions.py. When an @file: mention path is not found relative to the workspace, the code falls back to Path(file_path) without traversal, symlink, or workspace...

CVE-2026-14361

CVE-2026-14361 Consul Template 的 writeToFile 辅助函数直接打开操作者提供的目标路径，并跟随被链接的路径组件，从而使渲染输出能够逃逸预期目录并覆盖已存在的文件。 简介 我在审查 HashiCorp Consul Template 时发现了这个问题，当时脑海中有一个直接的文件系统安全问题： 如果writeToFile 收到的路径看似位于预期目录之内，它是否会验证文件系统实际将数据写入何处？ 在本例中，答案是否定的。 writeToFile 模板辅助函数通过 os.Create 或 os.OpenFile 直接打开用户提供的最终路径。...

CVE-2025-27591

CVE-2025-27591 - Privilege Escalation via below This repository contains an exploit for CVE-2025-27591 , a privilege escalation vulnerability in the Linux monitoring tool Below. 🛠️ Vulnerability Details CVE : CVE-2025-27591 CVSS Score : 7.8 High Affected Tool : below prior to v0.9.0 Vulnerability ...

CVE-2025-27591-Below

CVE-2025-27591-Below 📌 Description This is a proof-of-concept PoC exploit for CVE-2025-27591 , a local privilege escalation vulnerability in the below system monitor tool. The issue arises from unsafe handling of log files /var/log/below/errorroot.log when executed with elevated privileges. By...

CVE-2024-53691

CVE-2024-53691 https://www.qnap.com/en/security-advisory/qsa-24-28 https://vulners.com/cve/CVE-2024-53691 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 8.7 "If exploited, the link following vulnerability could allow remote attackers who have gained user access to traverse the fi...

EUVD-2026-77530

Description A topology's topology.blobstore.map lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both AsyncLocalizer and Container.createBlobstoreLinks, and the...

CVE-2026-82427 Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name

Description A topology's topology.blobstore.map lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both AsyncLocalizer and Container.createBlobstoreLinks, and the...

CVE-2026-82427

Description A topology's topology.blobstore.map lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both AsyncLocalizer and Container.createBlobstoreLinks, and the...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Executive summary macOS Music and TV do an insecure rename resulting in FDA by gaining full control over the user's TCC.db I reported this bug in separate tickets for each app, feel free to merge if applicable. The underlying problem is that these apps have FDA but fail to sanitize their file...