CVE-2026-43284

🚨 CVE-2026-43284 - Dirty Frag 🚨 Universal Linux Kernel Local Privilege Escalation 📋 Overview Dirty Frag also known as Copy Fail 2 is a high-impact local privilege escalation vulnerability in the Linux kernel. It allows an unprivileged local user to obtain root privileges on affected systems...

CVE-2023-6063-PoC

PoC for CVE-2023-6063: WP Fastest Cache 1.2.2 Unauthenticated Blind SQL Injection -red A Proof on Concept for CVE-2023-6063, a time-based blind SQL injection vulnerability in WP Fastest Cache ≤1.2.2. Extracts hashed passwords userpass and emails useremail from the wpusers table by abusing the...

DirtySlide

DirtySlide Unprivileged → root macOS LPE. An 8-byte OOB read/write into kernel memory adjacent to a dyld shared-cache page, from a missing in-page bounds check in the v5 slide walk vmsharedregionslidepagev5, reachable via syscall 536. Patched in macOS 26.5.2 25F84, xnu-12377.121.10. Vulnerable...

page-cache-corruption-lpes

Page Cache Corruption LPEs 3 Linux kernel local privilege escalation exploits. Same bug class as Dirty COW and Dirty Pipe. Root shell in seconds. Every major distro affected. All three corrupt the kernel's page cache — the in-memory copy of files that processes actually read and execute. The...

CVE-2024-6769

Blogpost: CVE-2024-6769 Poisoning the activation cache to elevate from medium to high integrity This blog is about two chained bugs: Stage one is a DLL Hijacking bug caused by the remapping of ROOT drive and stage two is an Activation Cache Poisoning bug managed by the CSRSS server. The first sta...

meltdown-exploit

MELTDOWN エクスプロイト PoC 投機的実行最適化は、安全でない方法でコードを実行し、キャッシュなどのマイクロアーキテクチャにデータの痕跡を残します。 Lipp 他 2018 は 2018-01-09 にコードを https://github.com/IAIK/meltdown で公開しました。詳細は論文 https://meltdownattack.com/meltdown.pdf を参照してください。 現時点では linuxprocbanner のみダンプ可能です。アクセスするメモリがキャッシュにある必要があり、/proc/version から読み取るたびに...

CVE-2022-45059-demo

CVE-2022-45059-demo Varnish Cache releases 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.1.0, 7.1.1 and 7.2.0 have a request smuggling vulnerability where an attacker can request that the content-length header is made hop-by-hop. This is a demo consisting of a Spring Boot web application running behind a...

CVE-2023-6063

CVE-2023-6063 PoC Reference Unauthenticated SQL Injection Vulnerability Addressed in WP Fastest Cache 1.2.2 | WPScan Plugin setting Enable "WP Fastest Cache". PoC The "wordpressloggedin" cookie parameter is vulnerable. $ python sqlmap.py --dbms=mysql -u "http://127.0.0.1/wp-login.php"...

dnspooq

dnspooq DNSpooq PoC - dnsmasq cache poisoning CVE-2020-25686, CVE-2020-25684, CVE-2020-25685 For educational purposes only Requirements Docker compose Docker Exploit Launch containers $ docker-compose up -d Run exploit.py $ docker-compose exec attacker bash bash-5.0 python exploit.py Querying...

CVE-2025-53694

CVE-2025-53694: Information Disclosure in ItemService API with a restricted anonymous user, leading to exposure of cache keys using a brute-force approach The ItemService API, accessible at /sitecore/shell/api/sitecore/ItemService/GetChildren, allows unauthenticated users to query the Sitecore...

WP Google Maps < 9.0.48 - Cross-Site Scripting

WP Google Maps WordPress plugin 9.0.48 contains a stored XSS vulnerability caused by unsanitized user input in AJAX actions, letting unauthenticated attackers execute scripts via stored payloads. id: CVE-2025-11307 info: name: WP Google Maps 9.0.48 - Cross-Site Scripting author: 0xAkoko severity:...

Etherpad 2.1.0 <= 3.0.0 - Cross-Site Scripting

Etherpad versions 2.1.0 through 3.0.0 reflect the x-proxy-path request header into admin HTML, JavaScript, and CSS responses without sanitization. An attacker can abuse this behavior to inject crafted content into generated resource URLs, enabling cross-site scripting and cache poisoning scenario...

WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting

WordPress W3 Total Cache plugin before 2.1.5 is susceptible to cross-site scripting via the extension parameter in the Extensions dashboard, when the setting 'Anonymously track usage to improve product quality' is enabled. The parameter is output in a JavaScript context without proper escaping...

W3 Total Cache < 2.8.2 - Log File Exposure

The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF...

rootpacket-cve-2026-31431

rootpacket CVE-2026-31431 A Linux Docker-to-host cryptojacking toolkit captured from live attacks on Kinryū Labs honeypots. It breaks in through an exposed Docker Engine API, escapes the container to root the host with CVE-2026-31431 , installs a kernel rootkit, and runs an XMRig Monero miner. Fu...

CVE-2022-0847

CVE-2022-0847 Dirty Pipe Linux Kernel Privilege Escalation Analysis toc This article was first published on Huawei Security's official account, this is the blog version more complete First published link: https://mp.weixin.qq.com/s/6VhWBOzJ7uu80nzFxe5jpg Vulnerability Introduction Vulnerability I...

cve_2026_31431

CVE-2026-31431 "Copy Fail" ツールキット 2026年4月29日に開示されたLinuxの algifaead / authencesn ページキャッシュ・スクラッチ書き込みバグに対する検出器および概念実証LPEです。 開示レポート: https://xint.io/blog/copy-fail-linux-distributions 許可...

CVE-2023-6063-PoC

CVE-2023-6063 PoC Reference Unauthenticated SQL Injection Vulnerability Addressed in WP Fastest Cache 1.2.2 | WPScan Plugin setting Enable "WP Fastest Cache". PoC The "wordpressloggedin" cookie parameter is vulnerable. $ python sqlmap.py --dbms=mysql -u "http://127.0.0.1/wp-login.php"...

dirtyclone-exploit

DirtyClone エクスプロイトフレームワーク CVE-2026-46331 — Linux カーネルローカル権限昇格 TC pedit + IPsec TEE ページキャッシュ破損 · 影響を受けるカーネル: ≤ 6.12.9 ╔═══════════════════════════════════════════════════════════════╗ ║ ║ ║ | \ | | / | | ║ ║ | | | | | '| | | | | | | |/ | ' \ / \ ║ ║ | || | | | | || || | || | | | | | / ║ ║ |/||| |,...

Airachnid-Burp-Extension

Web Cache Deception Burp Extension A Burp extension to test applications for vulnerability to the Web Cache Deception attack. Once the extension has been loaded, it can be accessed in the Target - Sitemap tab and right click on the resource that should be tested. A context sensitive menu item...