POC

POC For research purposes only! A public collection of POCs & Exploits for the vulnerabilities I discovered. CVE-2022-22583 PackageKit : An application may be able to access restricted files SIP Bypass CVE-2022-26690 PackageKit : A malicious application may be able to modify protected parts of th...

CVE-2023-32422-a-macOS-TCC-bypass-in-sqlite

CVE-2023-32422 - 在 sqlite 中的 macOS TCC 绕过...

hm-surf

Evaluador de HM-Surf Evalúa la susceptibilidad al CVE-2024-44133 de los navegadores comunes de macOS. También contiene el HTML que toma una captura de pantalla y la descarga junto con la extracción de ubicación. Uso - evaluador Para ejecutar el evaluador, que evalúa CVE-2024-44133 en todos los...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Executive summary macOS Music and TV do an insecure rename resulting in FDA by gaining full control over the user's TCC.db I reported this bug in separate tickets for each app, feel free to merge if applicable. The underlying problem is that these apps have FDA but fail to sanitize their file...

CVE-2023-32407-a-macOS-TCC-bypass-in-Metal

CVE-2023-32407-un-macOS-TCC-bypass-en-Metal...

CVE-2023-26818

Descargo de responsabilidad Este exploit ha sido creado únicamente con fines de investigación y para el desarrollo de técnicas defensivas efectivas. No está destinado a ser utilizado para actividades maliciosas o no autorizadas. El autor y el propietario del script rechazan cualquier...

CVE-2020-9934

CVE-2020-9934 此概念验证是一个简单的Swift程序，它会使自身和终端获取每个kTCCService权限（从tccd中提取），然后执行四项操作： 在受TCC保护的目录中创建名为""的文件 从受TCC保护的目录中读取该文件的数据 列出TCC目录中的所有文件（包括""） 从受TCC保护的目录中删除该文件 用法： ./bypasstc 请参阅Medium上的完整文章...

CVE-2025-24204

CVE-2025-24204 About CVE-2025-24204 is a vulnerability that allows reading any process memory on SIP-enabled macOS systems. The root cause of this vulnerability stems from adding an excessively powerful entitlement com.apple.system-task-ports.read to the gcore binary. Exploiting this vulnerabilit...

CVE-2022-26726-POC

CVE-2022-26726 受影响版本 作为一名学生，我能够测试此漏洞的设备有限。我目前测试过的版本包括 MacOS 12.3.1、MacOS 12.3、MacOS 12.0、MacOS 10.15.7 和 MacOS 11.6.1。该漏洞在所有测试版本上均有效。 那么漏洞是什么？ 影响：恶意应用程序可能能够绕过某些隐私偏好设置 描述：当可执行文件在运行时被删除，该进程能够绕过屏幕录制以及某些辅助功能设置的限制，即按键注入（使用 metasploit）。 可能的原因：macOS 无法找到该进程父可执行文件的权限，因此不会阻止屏幕录制。然而，令人困惑的是，摄像头和麦克风仍然被正确限制。...

MSF-screenrecord-on-MacOS

MSF-screenrecord-on-MacOS !!! Esta vulnerabilidad ha sido descubierta o tomada simultáneamente por Sudhakar Muthumani de Primefort Private Limited, Khiem Tran y listada como CVE-2022-22600. Esto a pesar de que ya había enviado un correo a Apple sobre esto en 2021. Versiones afectadas Como...

CVE-2026-39309: User Interface (UI) Misrepresentation of Critical Information

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Electron configuration is vulnerable to TCC Bypass via Prompt Spoofing, allowing local attackers to trigger misleading macOS permission...

CVE-2026-39309

CVE-2026-39309 affects Trilium Notes before v0.102.2. The Electron configuration allows a RunAsNode fuse to launch the app in a special Node.js mode (-e) that can execute arbitrary commands with Trilium’s permissions, enabling a local attacker to spoof macOS TCC prompts. An attacker could trigger...

EUVD-2026-31008

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Electron configuration is vulnerable to TCC Bypass via Prompt Spoofing, allowing local attackers to trigger misleading macOS permission...

CVE-2026-39309

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Electron configuration is vulnerable to TCC Bypass via Prompt Spoofing, allowing local attackers to trigger misleading macOS permission...

CVE-2025-15523 TCC Bypass via Inherited Permissions in Bundled Interpreter in Inkscape.app

MacOS version of Inkscape bundles a Python interpreter that inherits the Transparency, Consent, and Control TCC permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging the...

CVE-2025-1398

Mattermost Desktop App versions =5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency, Consent, and Control TCC via code injection...

CVE-2025-64723 Arduino IDE for macOS has TCC Bypass via Dynamic Library Injection

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows attackers to inject malicious dynamic libraries into the...

CVE-2025-64723 Arduino IDE for macOS has TCC Bypass via Dynamic Library Injection

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows attackers to inject malicious dynamic libraries into the...

Libre Office TCC Bypass via Bundled Interpreter vulnerability (Dec 2025) - Mac OS X

Libre Office is prone to a tcc bypass via bundled interpreter vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2025-14714 TCC Bypass via Inherited Permissions in Bundled Interpreter

An Authentication Bypass vulnerability existed where the application bundled an interpreter Python that inherits the Transparency, Consent, and Control TCC permissions granted by the user to the main application bundle By executing the bundled interpreter directly the attacker's scripts run with...