138 matches found
PT-2026-47913
Name of the Vulnerable Software and Affected Versions Winlogon affected versions not specified Description Improper link resolution before file access, also known as link following, allows an authorized attacker to elevate privileges locally on the system. Recommendations At the moment, there is ...
Windows Registry Security Audit Scanner
This C++ program is a Windows Registry Security Scanner designed for defensive auditing. It checks the presence and status of critical system registry keys such as LSA, Windows Defender, Winlogon, and system policy configurations. It also inspects user accessibility-related registry paths under...
📄 Microsoft WinLogon Registry Deletion / Privilege Escalation
This code represents a highly destructive proof of concept targeting Windows WinLogon and Registry access control mechanisms to achieve privilege escalation and system integrity compromise. The exploit is built around abusing Registry symbolic links and session-based Accessibility paths to redire...
VulnCheck KEV: CVE-2026-25187
Improper link resolution before file access 'link following' in Winlogon allows an authorized attacker to elevate privileges locally...
CVE-2026-25187
Improper link resolution before file access 'link following' in Winlogon allows an authorized attacker to elevate privileges locally...
The vulnerability of the Winlogon entry program in Windows operating systems allows attackers to escalate their privileges.
The vulnerability of the Winlogon entry program in Windows operating systems is related to the incorrect definition of symbolic links during access to the file. Exploiting this vulnerability can allow attackers to enhance their privileges...
EUVD-2026-10660
Improper link resolution before file access 'link following' in Winlogon allows an authorized attacker to elevate privileges locally...
EUVD-2026-10659
Improper link resolution before file access 'link following' in Winlogon allows an authorized attacker to elevate privileges locally...
CVE-2026-25187
Improper link resolution before file access 'link following' in Winlogon allows an authorized attacker to elevate privileges locally...
CVE-2026-25187
Improper link resolution before file access 'link following' in Winlogon allows an authorized attacker to elevate privileges locally...
CVE-2026-25187 Winlogon Elevation of Privilege Vulnerability
...
CVE-2026-25187
Improper link resolution before file access 'link following' in Winlogon allows an authorized attacker to elevate privileges locally...
CVE-2026-25187
CVE-2026-25187 is a Winlogon elevation-of-privilege vulnerability described as improper link resolution before file access (link following). It is a local vulnerability in Windows Winlogon that could allow an authorized attacker to elevate privileges to SYSTEM with no user interaction required. T...
CVE-2026-25187 Winlogon Elevation of Privilege Vulnerability
...
Winlogon Elevation of Privilege Vulnerability
Improper link resolution before file access 'link following' in Winlogon allows an authorized attacker to elevate privileges locally...
PT-2026-24311
Name of the Vulnerable Software and Affected Versions Windows versions affected versions not specified Description A flaw exists in the Winlogon login program of Windows operating systems related to incorrect handling of symbolic links during file access. Exploitation of this issue could allow an...
CVE-2026-25187: Improper Link Resolution Before File Access
Improper link resolution before file access 'link following' in Winlogon allows an authorized attacker to elevate privileges locally...
Microsoft Winlogon 后置链接漏洞
Microsoft Winlogon is a component built into the Windows NT series operating system developed by Microsoft. There is a post-release vulnerability in Microsoft Winlogon. Attackers can exploit this vulnerability to gain elevated privileges. The following products and versions are affected: Windows ...
Windows Registry Persistence Via Userinit
This Metasploit module will install a payload that is executed during user logon. It writes a payload executable to disk and modifies the Userinit registry value in "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" to append the payload path, causing it to execute when any user logs in...