CVE-2019-0752

https://www.thezdi.com/blog/2019/5/21/rce-without-native-code-exploitation-of-a-write-what-where-in-internet-explorer PoC exploit for CVE-2019-0752 Targets Internet Explorer 11 32bit on Windows 10 x64 up to RS4, RS5? Uses special address values in adddition to some path magic to avoid using...

CVE-2024-4883

CVE-2024-4883 PoC for CVE-2024-4883 Progress WhatsUp Gold WriteDatafile Unauthenticated Remote Code Execution CVE-2024-4883 Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/progress-whatsup-gold-WriteDataFile-CVE-2024-4883-RCE/ Usa...

CVE-2020-1362

Explotando un bug de Elevación de Privilegios en Windows 10 CVE-2020-1362 Explotación de bug de corrupción de memoria - análisis de CVE-2020-1362 WalletService corrigió bugs de Elevación de Privilegios en el último Patch Tuesday, uno de los bugs fue asignado con CVE-2020-1362. El bug aprovecha un...

LPE---CVE-2020-0796

Uso: Asegúrese de que Python esté instalado y luego ejecute poc.py. Windows Kernel Write-What-Where CVE-2020-0796 Exploit Diseñado únicamente para fines educativos y de prueba en entornos corporativos. MasterSpl0it no se hace responsable del código, úselo bajo su propio riesgo. POC reescrito de...

CVE-2020-1337-exploit

CVE-2020-1337 Escalada de privilegios en Windows esto es un exploit WWW write-what-where créditos Junyu Zhou @md5salt, quien me dijo que podría haber un nuevo bug. Wenxu Wu @ma7h1as, encontré el bug y escribí este exploit. cómo funciona en el parche de CVE-2020-1048, Microsoft añadió el código de...

CVE-2026-16513

The userspace verifier zvrfyrtiosqecopyingethandles in subsys/rtio/rtiosyscalls.c subsys/rtio/rtiohandlers.c before v4.3.0 validated the RTIO object handle and the sqes input array, but not the handle out-parameter. On the first loop iteration it executed handle = sqe, storing the kernel address ...

CVE-2020-1206

En la vulnerabilidad SMBGhost CVE-2020-0796 hablé sobre una técnica de primitiva write-what-where mediante el uso de una vulnerabilidad de desbordamiento de enteros para cambiar el puntero Alloc.Userbuffer para que apunte a una dirección deseada y escribir datos arbitrarios en ella. Al igual que...

Exploit for Write-what-where Condition in Linux Linux_Kernel

DirtyFrag-Galaxy 한국어 · English DirtyFragCVE-20...

Exploit for Write-what-where Condition in Linux Linux_Kernel

DFRoot — SM-S938B Galaxy S25 Ultra Adapted Version · Quick M...

CVE-2026-43499-ZFOLD4

CVE-2026-43499-ZFOLD4 Device-specific research port of CVE-2026-43499 IonStack PI write-what-where for the Canadian Galaxy Z Fold4 SM-F936W on firmware F936WVLU1AVGA. This repository is the Fold4 counterpart of CVE-2026-43499-S24U and CVE-2026-43499-A36. It captures current incomplete progress:...

CVE-2026-36981-Kernel-EoP-PoC

CVE-2026-36981-Kernel-EoP-PoC Kernel write-what-where condition within the pwdrvio.sys kernel driver of MiniTool. Demonstrates a debugger-assisted arbitrary kernel write primitive that can be leveraged toward privilege escalation. 2026-02-09 Vendor notified 2026-03-05 Vendor acknowledged 2026-03-...

POC_CVE-2025-29943_Write-what-where-Condition

StackWarp: PoC for CVE-2025-29943 Prueba de concepto para la vulnerabilidad de hardware StackWarp CVE-2025-29943 en procesadores AMD. Esta falla permite a un atacante con privilegios de administrador en un host hipervisor manipular la configuración de la canalización de la CPU para corromper el...

CVE-2026-25262 Write-what-where Condition in Primary Bootloader

Memory corruption while processing a crafted ELF file in the Primary Bootloader...

CVE-2026-25262

CVE-2026-25262 is a write-what-where memory corruption in the Primary Bootloader (PBL) of Qualcomm Snapdragon chips (MDM and MSM series), triggered by processing a crafted ELF file during Sahara protocol handshake in Emergency Download Mode. An attacker with physical access can bypass secure boot...

CVE-2026-25262: Write-what-where Condition

Memory corruption while processing a crafted ELF file in the Primary Bootloader...

CVE-2026-17052

CVE-2026-17052 affects Zephyr RTOS builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y enabled (practically, v3.6.0 through v4.4.0). The syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated the port device object but omitt...

Exploit for Write-what-where Condition in Linux Linux_Kernel

Dirty-Frag Linux CVE-2026-43284 & CVE-2026-43500 Copied f...

CVE-2026-94146

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub110BC of the file BSMEM64W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. Th...

EUVD-2026-83847

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub110BC of the file BSMEM64W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. Th...

CVE-2026-94146 BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub110BC of the file BSMEM64W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. Th...