tethr

Tethr Android Tethering Provisioning Check Bypass CVE-2017-0554 This is the repository for the proof of concept Tethr app which demonstrates CVE-2017-0554 to bypass the tether provisioning check on Android prior to version 7.1.2. Informational Blog Post Download Tethr Demo Video...

CVE-2026-85491 Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepareaction with a version that memoises how a path resolved: which...

polkit-CVE-2021-3560_writeup

Try Hack Me - Polkit:CVE-2021-3560 Author: Atharva Bordavekar Difficulty: Info Points: 32 Vulnerability: CVE-2021-3560 we will first check the version of the polkit version to get some better insights. root@kitploit: apt list --installed | grep policykit-1 policykit-1/focal,now 0.105-26ubuntu1...

CVE-2025-6554

CVE-2025-6554 root@kitploit: function leakhole let x; delete x?.y?.a; return y; let y; function pwn let hole = leakhole; %DebugPrinthole; pwn; Bug A variable y was accessed before declaration. Normally this should trigger a ReferenceError TDZ, but in older V8, when combined with delete x?.y, the...

automation-controller: automation-controller-container: automation-controller: workflow job template node execute permission check bypassed by creating a node with a null unified_job_template and then patching it, allowing a single workflow-admin to execute any other tenant's job template with the victim's credentials (cross-tenant privilege escalation)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The execute-permission check on a workflow job template node's unified job template is skipped when the node's currently stored unified job template is empty: the check inspects only the existing value, not the...

EUVD-2026-85540

Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...

kernel: fanotify: fix false positive on permission events

A flaw was found in the Linux kernel's fanotify subsystem. This vulnerability allows for a bypass of permission checks because the fsnotifygetmarksafe function may incorrectly return false for marks on unrelated groups. This could enable an attacker to perform unauthorized actions by circumventin...

kernel: fanotify: fix false positive on permission events

A flaw was found in the Linux kernel's fanotify subsystem. This vulnerability allows for a bypass of permission checks because the fsnotifygetmarksafe function may incorrectly return false for marks on unrelated groups. This could enable an attacker to perform unauthorized actions by circumventin...

kernel: fanotify: fix false positive on permission events

A flaw was found in the Linux kernel's fanotify subsystem. This vulnerability allows for a bypass of permission checks because the fsnotifygetmarksafe function may incorrectly return false for marks on unrelated groups. This could enable an attacker to perform unauthorized actions by circumventin...

CVE-2026-93602

A flaw was found in rustls-webpki. The component contains faulty Certificate Revocation List CRL authority-matching logic, which incorrectly compares only the first distribution point against each CRL's issuing distribution point, ignoring others. This vulnerability allows an attacker with a...

CVE-2026-8069

From an Acer Named Pipe to NT AUTHORITY\SYSTEM: CVE-2026-8069 Acer NitroSense and PredatorSense 3.x installed a Windows service called PSSvc that exposed a custom named-pipe protocol to local users. One protocol command accepted a caller-controlled executable path, duplicated the token of...

DolibabyPhp

DolibabyPhp An authenticated RCE exploit for Dolibarr ERP/CRM CVE-2023-30253. Installation You can either install the package from the PyPi repository with pip or git clone the source directly from GitHub. root@kitploit: pip install dolibabyphp Usage root@kitploit: Usage: dolibabyphp OPTIONS...

CVE-2021-24356

CVE-2021-24356 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Subscriber + Arbitrary Plugin Installation Description A lack of capability checks and insufficient nonce check on the AJAX action in the plugin, made it possible for authenticated users to install arbitrary plugins on vulnerabl...

CVE-2026-52886

Path Traversal: startswith Prefix Check Bypass Notepad++ — Arbitrary File Read viasession.xml backupFilePath Traversal Advisory GHSA: GHSA-rqfm-pw34-r7j6 CVE: CVE-2026-52886 Severity: Moderate Affected: v8.9.6.4 Patched: v8.9.7 Patch Commit: 7e66f36 Affected File: PowerEditor/src/Notepadplus.cpp...

spectre-attack-example

Spectre Attack Example January 2, 2018 CVE-2017-5753 and CVE-2017-5715 "Spectre" exploit example What is this? We place the text "The Magic Words are Squeamish Ossifrage." in memory, and then we attempt to read it using the vulnerability. If the system is vulnerable, you will see the same text on...

SpeculativeExecutionAssessment

SpeculativeExecutionAssessment Assesses a system for the "speculative execution" vulnerabilities described in: CVE-2017-5715 branch target injection CVE-2017-5753 bounds check bypass CVE-2017-5754 rogue data cache load WARNING: Ensure that "Prefer 32-bit" is not checked in the build options...

CVE-2026-32475

CVE-2026-32475 PoC: Elementor Pro Subida Arbitraria de Archivos No Autenticada a RCE Subida Arbitraria de Archivos Pre-Autenticación en Elementor Pro que Conduce a Ejecución Remota de Código Prueba de concepto para CVE-2026-32475, una subida arbitraria de archivos no autenticada crítica en el...

UBUNTU-CVE-2026-93602

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

collision-webshell

Webshell Collision This repository contains 2 files that have the same MD5 hash: webshell.php normal.php MD5 for the files: root@kitploit: $ md5sum .php b719a17ae091ed45fb874c15b2d9663f normal.php b719a17ae091ed45fb874c15b2d9663f webshell.php Hexdump for the webshell.php: root@kitploit: $ hexdump...

EUVD-2026-82619

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...