kernel-mii

Fundación de archivo de objeto Beacon de Cobalt Strike para explotación del kernel mediante CVE-2021-21551. Creado por Tijme. Gracias a Alex por enseñarme. Posibilitado por Northwave Security Descripción Este es un Archivo de Objeto Beacon BOF de Cobalt Strike CS que explota CVE-2021-21551. Solo...

CVE-2024-30804

ASUS Driver LPE PoC Physical Memory Abuse This is a PoC for Local Privilege Escalation LPE that exploits the AsInsHelp64.sys driver. It abuses a legitimate, signed ASUS driver to map physical memory and overwrite kernel tokens, eventually gaining NT AUTHORITY\SYSTEM privileges. 🎯 Vulnerability In...

cve-2026-29923

CVE-2026-29923 — pstrip64.sys Local Privilege Escalation A minimal proof-of-concept for CVE-2026-29923, a vulnerability in the pstrip64.sys kernel driver EnTech Taiwan PowerStrip ≤ 3.90.736 that allows an unprivileged user-mode process to escalate to NT AUTHORITY\SYSTEM. The Bug pstrip64.sys...

CVE-2025-29824-Exploit

🚨 CVE-2025-29824 Exploit: PipeMagic Ransomware Chain 📌 Critical Vulnerability Overview Privilege Escalation Flaw in Windows CLFS → SYSTEM Privilege Hijack Exploited in Active Ransomware Attacks by Storm-2460 Threat Group 🖥️ Affected Systems Expand System List 🧩 Exploit Chain Workflow graph LR...

amd-ryzen-master-driver-v17-exploit

Cobalt Strike Beacon Object File for kernel exploitation using AMD's Ryzen Master Driver version 17. Built by Tijme. Credits to Alex for teaching me! Made possible by Northwave Security Description This is a Cobalt Strike CS Beacon Object File BOF and executable which exploits AMD's Ryzen Master...

CVE-2026-14548

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

EUVD-2026-55947

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

CVE-2026-14548

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

CVE-2026-14548

The CVE concerns the Ray Enterprise Translation WordPress plugin (affected:

PT-2026-70065

Name of the Vulnerable Software and Affected Versions Ray Enterprise Translation versions prior to 1.7.4 Description The Ray Enterprise Translation WordPress plugin fails to perform capability or nonce checks on an AJAX action. This allows any authenticated user, such as those with Subscriber...

CVE-2026-17023

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Goog...

CVE-2026-17023 Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Goog...

CVE-2026-17023

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Goog...

CVE-2026-70474 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...

CVE-2026-11882

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...

CVE-2026-11882

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...

CVE-2026-11882 Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...

CVE-2026-11882

Builderall for WordPress plugin prior to version 3.0.2 contains an OAuth state handling flaw: it does not bind the OAuth flow state to the initiating user session, enabling unauthenticated attackers to finish the connection flow and overwrite the stored third‑party integration access token. A dur...

EUVD-2026-51697

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...

CVE-2026-16587

The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...