printix-CVE-2022-25090

CVE-2022-25090 不再以普通用户身份打印作业，而是以SYSTEM身份打印系统安全策略，图个乐。 浏览文档 » 查看演示 . 报告错误 . 请求功能 目录 关于项目 构建工具 准备工作 先决条件 安装 使用说明 路线图 贡献指南 许可证 作者 致谢 关于项目 PrintixService.exe 中存在“在具有不安全权限的目录中创建临时文件”漏洞，影响 Printix 的“Printix Secure Cloud Print Management”版本 1.3.1106.0 及更低版本。该漏洞允许任何登录用户将任何可执行文件或文件提升至 SYSTEM 上下文。这是通过利用安装程...

BlueKeep

Bluekeep 概念验证 此仓库包含关于CVE-2019-0708的研究。 Bluekeep 或 CVE-2019-0708 是一个 RCE 漏洞，影响以下版本的 Windows 系统： Windows 2003 Windows XP Windows Vista Windows 7 Windows Server 2008 Windows Server 2008 R2 该漏洞发生在预认证阶段，有可能在 NT Authority\system 用户安全上下文中执行任意恶意代码。 工作原理 通过发送特制数据包，攻击者能够将 Channel ID 的值设置为 RDP...

printix-CVE-2022-25089

CVE-2022-25089 系统管理员的完全噩梦：用户无需认证即可随时随地更改注册表。 探索文档 » 查看演示 . 报告错误 . 请求功能 目录 关于项目 构建工具 开始使用 先决条件 安装 使用 路线图 贡献 许可证 作者 致谢 关于项目 PrintixService.exe中存在一个“特权API使用不当”漏洞，在Printix的“Printix Secure Cloud Print Management”1.3.1106.0及以下版本中，本地或远程攻击者能够通过UITasks.PersistentRegistryData参数以SYSTEM上下文更改所有HKEY Windows注册表...

VirtualLockSensorLPE

VirtualLockSensorLPE 描述 本地权限提升 PoC 利用程序，针对运行在 Windows 上的 Elliptic Virtual Lock Sensor 版本 3.1.60531.2，该传感器默认安装在特定 Lenovo 笔记本电脑型号上。允许通过更改注册表项的权限，从普通用户上下文在 SYSTEM 上下文中执行负载。 来自 Lenovo 的官方公告：https://support.lenovo.com/us/en/productsecurity/LEN-182738 请在使用前阅读注意事项。 如何构建 1. 使用 git clone --recursive 克隆仓库。...

CVE-2023-7261

CVE-2023-7261 Google Chrome 更新程序 DosDevices 本地权限提升漏洞 详细信息： 此漏洞允许本地攻击者在受影响的 Google Chrome 安装上升级权限。攻击者必须首先获得在目标系统上执行低权限代码的能力才能利用此漏洞。 具体漏洞存在于更新机制中。通过创建 DOS 设备重定向，攻击者可以滥用更新机制从不受信任的位置启动可执行文件。攻击者可以利用此漏洞提升权限并以 SYSTEM 上下文执行任意代码。 参考： https://issues.chromium.org/issues/40064602 https://zerozenx.com/...

FortiLPE

描述 针对运行在Windows上的FortiClient VPN的CVE-2025-62676 / EUVD-2025-206993本地权限提升PoC利用程序。通过任意XML文件写入，以普通用户上下文在SYSTEM上下文中执行载荷。该PoC已在Windows 11 Pro上的FortiClient 7.4.0版本上测试通过。根据供应商信息，以下版本受影响： 7.4.0 - 7.4.4 7.2.0 - 7.2.12 7.0（所有版本） 该漏洞通过Trend Micro的Zero Day...

CVE-2025-60710

CVE-2025-60710 这是针对 \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration 计划任务中本地权限提升漏洞的概念验证代码。 当该计划任务启动时，taskhostw.exe 进程会尝试打开 C:\Users%username%\AppData\Local\CoreAIPlatform.00\UKP 目录，并使用以下过滤器搜索子目录：????????-????-????-????-????????????。如果找到该目录，则会在未检查符号链接的情况下将其删除。 由于低权限用户默认可以在其自己的 %LOCALAPPDATA...

cve-2024-38077-madlicense_reproduction

CVE-2024-38077: Windows 远程桌面许可服务远程代码执行漏洞（"MadLicense"） I. 漏洞概述 CVE ID : CVE-2024-38077 别名 : MadLicense CVSS 评分 : 9.8（严重） 类型 : 堆缓冲区溢出（CWE-122） 发现者 : Ver, Lewis Lee, 彭志宁 描述 : Windows 远程桌面许可（RDL）服务中存在一个无需认证、零点击的远程代码执行漏洞。未认证的攻击者可以向 mstlsap.dll / tlslicense.dll 暴露的 RPC over TCP 端点发送特制的 RPC...

Foxit PDF Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the update...

CVE-2026-92180

pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of pdfforge PDF Architect. An attacker must first obtain the ability to...

CVE-2026-92180: Uncontrolled Search Path Element

pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of pdfforge PDF Architect. An attacker must first obtain the ability to...

PT-2026-92195

pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of pdfforge PDF Architect. An attacker must first obtain the ability to...

Microsoft Windows MIDI Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Windows MIDI...

Microsoft Windows UMPDDrvStretchBlt Improper Object Management Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the win32kfull...

VulnCheck KEV: CVE-2023-39470

PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut NG. Authentication is required to exploit this vulnerability. The specific flaw exists with...

CVE-2026-18262

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...

CVE-2026-18263 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...

CVE-2026-18263

The flaw is in the RAS RDP Backend Service of Parallels RAS Client, which exposes a dangerous function. A local low-privileged attacker can exploit it to execute arbitrary code as SYSTEM. CVSS 7.8 (HIGH). No patch or exploit details are provided in the documents. Monitor ZDI-26-556 for remediatio...

CVE-2026-18262

Parallels RAS Client contains a local privilege escalation vulnerability in the RAS RDP Backend Service , caused by an exposed dangerous function . A local attacker with the ability to execute low-privileged code can leverage this flaw to execute arbitrary code in the SYSTEM context, resulting in...

CVE-2026-18262 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...