root-dirtyc0w

root-dirtyc0w CVE-2016-5195 DirtyCow ルート権限昇格 Dirty COW は、Linux カーネルにおける競合状態の脆弱性でした。この脆弱性は、メモリマッピングのコピーオンライト COW 機能を扱うカーネル関数内に存在し、悪用されるとプロセスが読み取り専用ファイルに書き込むことを可能にしました。 この脆弱性の使用例としては、passwd 実行可能ファイルなどの SUID Set User ID バイナリを、/bin/sh を実行して root 権限を取得する別の elf 実行可能ファイル（当リポジトリで作成）で上書きすることが挙げられます。 Linux...

ghostlock-s26

GhostLock CVE-2026-43499 for the Galaxy S26 CVE-2026-43499 ported to the Samsung Galaxy S26 series — Android 16 / GKI 6.12. One binary, three kernel lines, dynamic parameter matching at runtime: theoretically covers the whole S26 series without per-build compilation. Most GhostLock porting effort...

CVE-2023-36407

CVE-2023-36407 これはCVE-2023-36407、Hyper-Vの権限昇格の脆弱性のPoCです。 https://github.com/pwndorei/CVE-2023-36407/assets/96749184/a8ef87d3-e0d0-40e5-9b23-35ab057a9c78 脆弱性 winhvr.sys!WinHvGet/SetVpStateを介した非ページプールへの/からのOOB読み取り/書き込み 再現手順 使用環境: Windows 11 22H2 x64 パッチ: kb5031354 WinHvSetVpStateの制御コード: 0x221268...

CVE-2026-90947 Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicio...

CVE-2026-90947

This vulnerability affects GIMP's Lighting Effects filter . When processing a specially crafted lighting preset file , the filter fails to properly validate the number of light sources, leading to an out-of-bounds write that corrupts memory. Exploitation requires a user to open a malicious preset...

EUVD-2026-77593

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicio...

CVE-2026-90947

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicio...

EUVD-2026-77595

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks...

propane

propane ProFTPD の modcopy モジュールにおける任意のファイル書き込みバグ（CVE-2015-3306）を悪用し、コード実行を試みます。...

cve-2019-6260

A Test and Debug Tool for ASPEED BMC AHB Interfaces Warning DO NOT USE THIS TOOL IF YOU HAVE NOT UNDERSTOOD ITS BEHAVIOURS IN THE CONTEXT OF YOUR TARGET MACHINE. This tool pokes at low-level hardware and firmware interfaces of your machine. Particularly, the act of probing implies uncertainty abo...

CVE-2024-53691

CVE-2024-53691 https://www.qnap.com/en/security-advisory/qsa-24-28 https://vulners.com/cve/CVE-2024-53691 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 8.7 "If exploited, the link following vulnerability could allow remote attackers who have gained user access to traverse the fi...

cve-2016-7190

Overview CVE-2016-7190 0 is a heap overflow in the Array.map function of ChakraCore that allows to overwrite adjacent memory. The main idea to gain arbitrary read-write access is to first allocate a number of consecutive JavaScript integer Arrays. and to exploit the overflow to manipulate the siz...

CVE-2021-21425

CVE-2021-21425 GravCMS 未認証の任意 YAML 書き込み/更新によるコード実行 CVE-2021-21425 参照 : https://pentest.blog/unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution/...

CVE-2023-42819

CVE-2023-42819 CVE-2023-42819 Vulnerability Description JumpServer Arbitrary File Write Vulnerability CVE-2023-42819 + CVE-2023-42820 = GetShell USAGE 1. Place the script and required files in the same directory 2. Ensure Google Chrome is installed, and obtain its version number root@kitploit: re...

PS4-6.20-WebKit-Code-Execution-Exploit

PS4 6.20 WebKit コード実行 PoC このリポジトリには、CVE-2018-4441 を利用した PlayStation 4 ファームウェア 6.20 向けの概念実証 PoC RCE エクスプロイトが含まれています。エクスプロイトはまず、wkexploit.js で任意読み取り/書き込みプリミティブと任意オブジェクトアドレス漏洩を確立します。次に、index.html で ROP チェーンを実行するフレームワークをセットアップし、デフォルトでは2つのテスト用 ROP チェーンのハイパーリンクを提供します。1つは sysgetpid システムコール、もう1つは sysgetu...

CVE-2026-33032

CVE-2026-33032 安全检查（读取 nginx 状态） root@kitploit: python3 main.py http://target:9000 --tool nginxstatus 列出配置 root@kitploit: python3 main.py 10.0.0.50 --tool nginxconfiglist 破坏性演示（写入并重载） root@kitploit: python3 main.py http://target:9000 \ --tool nginxconfigadd \ --payload poc.conf \ --content 'serve...

BlueGate

BlueGate 针对 CVE-2020-0609 和 CVE-2020-0610 的概念验证（拒绝服务 + 扫描器）。 这些漏洞允许未认证的攻击者通过 RD Gateway for RDP 以最高权限实现远程代码执行。 请仅用于研究和教育目的。 使用方式 确保已为 python3 安装 pyOpenSSL。 root@kitploit: usage: BlueGate.py -h -M check,dos -P PORT host positional arguments: host 主机 IP 地址 optional arguments: -h, --help 显示此帮助信息并退出 ...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

Pwnkit - CVE-2021-4034 Local Privilege Escalation Tested O...

CVE-2024-2887

CVE-2024-2887 This is a short writeup for the CVE-2024-2887, which I used to claim V8CTF M123. When define more types than kV8MaxWasmTypes, which can be achieved by padding more types in RecGroup, the types index can be more than 20bits and then overflowed. Then two types can be considered same a...

CVE-2026-46331

🚨 CVE-2026-46331 - Linux Kernel COW Bug Linux Kernel net/sched Partial Copy-on-Write COW Page Cache Corruption -orange?style=for-the-badge A Linux kernel vulnerability caused by incorrect Copy-on-Write COW handling in the traffic control tc packet editing subsystem. 📖 Overview CVE-2026-46331 is a...