WPTaskScheduler_CVE-2024-49039

WPTaskScheduler Persistence & CVE-2024-49039, as one of Attack Surface within Task Scheduler. WPTaskScheduler.dll is a component of Task Scheduler, since win 10 1507. This is likely a backdoor tool used for persistence, which was analyzed by security researchers, who found that able to bypass...

cve-2024-49039-task_scheduler_eop_reproduction

CVE-2024-49039: Windows Task Scheduler Elevation of Privilege Vulnerability Overview CVE-2024-49039 is a Windows Task Scheduler Elevation of Privilege EoP vulnerability that allows an authenticated attacker to escape the AppContainer sandbox, elevating from Low integrity AppContainer to Medium...

RedPersist

RedPersist RedPersist es una herramienta de persistencia de Windows escrita en C Compilación del Proyecto A continuación se mencionan las bibliotecas de terceros utilizadas en este proyecto. TaskScheduler https://github.com/dahall/TaskScheduler Fody https://github.com/Fody/Fody Load the Visual...

SharpMove

SharpMove - Ejecución autenticada .NET para hosts remotos Compilación Para compilar, abre el proyecto de Visual Studio y compílalo para la versión Release. Opciones WMI SCM DCOM Múltiples Programador de tareas Secuestro de DLL de servicio Secuestro de servidor DCOM Modificar tarea programada...

persistence-info.github.io

The repository tries to gather an information about Windows persistence mechanisms to make the protection/detection more efficient. Most of the information is well known for years, being actively used within various scenarios. Expect more. I am doing my best to add new entries each day. How it...

FullPowers

FullPowers FullPowers es una herramienta de Prueba de Concepto que creé para recuperar automáticamente el conjunto de privilegios predeterminado de una cuenta de servicio, incluyendo SeAssignPrimaryToken y SeImpersonate. Justificación En Windows, algunos servicios ejecutados como LOCAL SERVICE o...

CVE-2026-72945

Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally...

CVE-2026-72945

CVE-2026-72945 is an information disclosure vulnerability in Windows Task Scheduler , caused by the use of an uninitialized resource . An authorized local attacker with low privileges can exploit this to disclose information, with high confidentiality impact and no integrity or availability impac...

EUVD-2026-73113

Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally...

wptsextensions.dll

WptsExtensions.dll for exploiting Task Scheduler DLL Hijacking "won't fix " Load x64 visual studio environnement variables: root@kitploit: "C:\Program Files x86\Microsoft Visual Studio\2019\Community\VC\Auxiliary\Build\vcvars64.bat" Update the TCHAR script variable with a writable SYSTEM path whe...

CVE-2026-15380

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

CVE-2026-15380

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

EUVD-2026-45153

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

CVE-2026-15380

CVE-2026-15380 : A non-admin interactive user can achieve full SYSTEM code execution via a DCOM/task scheduler logic chain in Symantec ITMS. No network access or memory corruption required. Connected records confirm the vulnerability and impact as stated; no explicit exploit details, mitigations,...

CVE-2026-15380 Local privilege escalation in Symantec ITMS

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

CVE-2026-15380 Local privilege escalation in Symantec ITMS

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

XXL-JOB 安全漏洞

XXL-JOB is a distributed task scheduling platform developed by xuxueli. Versions of XXL-JOB 3.3.2 and earlier contain security vulnerabilities. These vulnerabilities stem from improper control of resource identifiers due to the parameter logId in the function logDetailCat of the Execution Log...

PureRAT: A Multi-Stage, Fileless RAT Utilizing Image Steganography and Process Hollowing

PureRAT: A Multi-Stage, Fileless RAT Utilizing Image Steganography and Process Hollowing By Prashanth A N and Mallikarjun Wali · April 20, 2026 PureRAT is an advanced remote access trojan RAT characterized by its complex infection stages. The intrusion sequence is initiated by a malicious .LNK fi...

MAL-2026-2884 Malicious code in forge-jsx (npm)

forge-jsx is a malicious npm package that impersonates an Autodesk Forge SDK. It was published as a fully-formed RAT from its first version on April 7, 2026. Installing the package on any non-CI machine deploys a persistent background agent that captures all keystrokes, monitors clipboard content...

CVE-2026-33619

PinchTab v0.8.3 exposes an unauthenticated blind SSRF via the scheduler’s webhook delivery path. When a task is submitted to POST /tasks with a user-controlled callbackUrl, the scheduler issues an outbound POST to that URL at terminal state. The webhook path only validated the URL scheme, failing...