CVE-2025-25747-HotelDruid-3-0-7-Reflected-XSS

CVE-2025-25747 - HotelDruid 3.0.7 反射型 XSS 漏洞 描述 DigitalDruid HotelDruid v.3.0.7 中存在跨站脚本攻击漏洞，攻击者能够通过 creabackup.php 端点中的 ripristinabackup 参数执行任意代码并获取敏感信息 严重性与影响 影响 攻击者可诱骗已认证用户访问精心构造的 URL，从而在其浏览器中触发恶意 JavaScript。潜在后果包括： 会话劫持： 攻击者可窃取会话 Cookie，非法访问用户账户。 钓鱼或恶意软件投递： 用户可能被重定向至恶意网站，或攻击者控制的脚本直接在界面中注入恶意内容。...

CVE-2024-32002

CVE-2024-32002 一个简单的概念验证，执行计算器（仅限 macOS 示例）。使用 git clone --recursive 命令时，此仓库还会拉取 https://github.com/markuta/hooky，其中包含一个 post-checkout 脚本。主要基于修复提交 t7406-submodule-update.sh 文件。 运行 注意 ：低于 2.45.1、2.44.1、2.43.4、2.42.2、2.41.1、2.40.2 和 2.39.4 的版本均受影响。 git clone --recursive...

CVE-2023-27326

Escape de VM de Parallels Desktop Este repositorio contiene un exploit para una vulnerabilidad de Parallels Desktop a la que se le ha asignado CVE-2023-27326. Esta vulnerabilidad permite a atacantes locales escalar privilegios en las instalaciones afectadas de Parallels Desktop. El exploit fue...

CVE-2020-12753-PoC

CVE-2020-12753-PoC Este repositorio contiene una prueba de concepto para 🔋📱❄️🥾🔓, una vulnerabilidad SBL1/aboot para ejecución de código arbitrario en Secure EL3 en el LG Stylo 4 AMZ/Q710ULM. Solo se ha probado en las actualizaciones 20a y 20c y con la variante SBL1 de la vulnerabilidad. - Makefile...

CVE-2024-4367-hands-on-01

!IMPORTANT Este repositorio es para aprender sobre vulnerabilidades. Realice este taller únicamente en un ordenador adecuado que usted gestione. No realice nunca actividades ilegales. Además, el autor no se hace responsable de ningún daño o responsabilidad derivados de este repositorio...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

CVE-2026-101919

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

[SECURITY] [DSA 6544-1] sabnzbdplus security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6544-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 05, 2026 https://www.debian.org/security/faq -...

[SECURITY] [DSA 6543-1] libreoffice security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6543-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 05, 2026 https://www.debian.org/security/faq -...

CVE-2024-4947-PoC

CVE-2024-4947 — Confusión de tipos en V8 Maglev → RCE completo PoC d8 Una cadena de explotación completa y autocontenida para CVE-2024-4947 confusión de tipos en V8 Maglev, desde el disparador inicial de la confusión de tipos hasta la ejecución arbitraria de código. El PoC se ejecuta contra una...

EUVD-2026-92524

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2026-101919

A vulnerability exists in the HyperShift operator where it copies user-provided kubeconfig secrets directly into the privileged control plane namespace without sufficient validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this by supplying a...

CVE-2026-101919

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2023-27326

Escape de máquina virtual de Parallels Desktop Este repositorio contiene un exploit para una vulnerabilidad de Parallels Desktop a la que se le ha asignado el CVE-2023-27326. Esta vulnerabilidad permite a atacantes locales escalar privilegios en instalaciones afectadas de Parallels Desktop. El...

CVE-2026-2796-escape-wasm-by-using-wasm

CVE-2026-2796 — Escape de la sandbox de WebAssembly de SpiderMonkey Cadena de exploits de prueba de concepto para CVE-2026-2796 , una mala compilación JIT / confusión de tipos en la optimización de importación WebAssembly de Mozilla SpiderMonkey componente "JavaScript: WebAssembly". Un módulo was...

CVE-2026-18718

Advisory: GHSA-pcfh-853f-q3gh · Severity: High CVSS 7.5 · Affected: Ghidra ≤ 12.1.2 · Fixed: c03a70d Ghidra 12.1.3 Opening someone else's Ghidra project was enough to execute their code. Ghidra 12.1.2 stores analyzer options inside the program database , and one of those options is a filesystem...

CVE-2025-64512

CVE-2025-64512 Ejecución Arbitraria de Código en pdfminer.six mediante Entrada PDF Manipulada PoC basado en https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp % python3 mkpickle.py Usage: mkpickle.py output Ex: mkpickle.py 'curl IP:PORT/rce' evil.pickle.gz % python3...

CVE-2026-63277

A flaw was found in LibreOffice. When linking spreadsheet cell ranges to external data sources in Calc, a document can specify an external Java database driver. By convincing a user to open a specially crafted document, a remote attacker can force the application to download and execute untrusted...

SUSE CVE-2019-25777

YAML versions before 1.27001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

CVE-2022-20186_CTXZ

CVE-2022-20186 漏洞利用 详细分析可在此处找到：here。这是 Arm Mali 内核驱动程序中的一个漏洞，我于 2022 年 1 月提交报告。该漏洞可用于从未受信任的应用域获得任意内核代码执行权限，进而禁用 SELinux 并获取 root 权限。 该漏洞利用已在 Google Pixel 6 上测试，支持从 2021 年 11 月到 2022 年 2 月的补丁级别。通过更改几个镜像偏移量，可以轻松添加对其他固件的支持。作为参考，我使用以下命令在 ndk-21 中通过 clang 编译：...