rust_syscalls

RUSTSYSCALLS Einzelner Stub für direkte und indirekte Syscalls mit Laufzeit-SSN-Auflösung für Windows. Funktionen: Eine einzige Zeile für all deine Syscalls Hash der Funktionsnamen zur Kompilierzeit Direkte oder indirekte Syscalls Unterstützung für x8664, WOW64 und natives x86 Entwickelt, um die...

RToolZ

RToolZ Ein verdeckter Lsass-Dumper - kann den ProcExp152.sys-Treiber ausnutzen, um PPL-Lsass zu dumpen. Was ist das Besondere daran? Es werden keine Aufrufe an MiniDump oder irgendwelche dbghelp.lib-Methoden verwendet, der gesamte Dump-Vorgang wird MANUELL vom Dumper durchgeführt, wobei die...

Hunt-Weird-Syscalls

Hunt-Weird-Syscalls Dies ist ein ETW-basierter POC zur Überwachung abnormaler Syscalls. Derzeit werden die Syscalls NtOpenThread und NtSetContextThread überwacht, um IOCs zu identifizieren, die sowohl auf direkte als auch auf indirekte Syscalls hinweisen. Beschreibung Dieses Projekt nutzt ETW,...

DEFCON-31-Syscalls-Workshop

Indirect Syscalls: un viaggio dall'alto verso il basso RedOps | Red Team Village | DEF CON 31 Per Iniziare Tutta la teoria e i playbook per gli esercizi si trovano nella wiki, che insieme ai POC preparati è il cuore di questo progetto. I POC per gli esercizi si trovano qui nella pagina principale...

CVE-2026-77768

CVE-2026-77768 is an authorization bypass in OpenPanel , an open-source analytics platform. The report.get tRPC procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned the report directly via getReportById(), which performs a findUnique with no project scoping. The ...

CVE-2026-77768 OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportByIdreportId directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consistin...

kubetcd

Kubetcd Wrapper di https://github.com/jpbetz/auger. Automatizza il deployment dei pod scrivendo direttamente in etcd. Include diverse funzioni per la post-esplorazione di etcd compromessi. Avvertenza !WARNING Questa è una PoC, non utilizzarla in un ambiente di produzione. Scrivere direttamente in...

GHSA-MPMW-F6H6-3G26 Winter: My Account preview exposes another backend user's profile by record ID

Impact Backend\Controllers\MyAccount, introduced in v1.2.13, declares an empty $requiredPermissions array so that any authenticated backend user can manage their own account. It implements the FormController behavior, which exposes three routable actions — create, update and preview — that each...

meshtastic-cve-2025-52464-poc

Meshtastic CVE-2025-52464 प्रूफ ऑफ कॉन्सेप्ट अवलोकन यह प्रोजेक्ट एक सॉफ्टवेयर-मात्र प्रूफ ऑफ कॉन्सेप्ट है जो CVE-2025-52464 का प्रदर्शन करता है, एक कमजोरी जो Meshtastic फर्मवेयर संस्करण 2.5.0 से 2.6.10 को प्रभावित करती है। यह कार्यान्वयन संवेदनशील फर्मवेयर के क्रिप्टोग्राफिक व्यवहार को पुनर्स्थाप...

CVE-2026-74285

A flaw was found in the Linux kernel's network subsystem. An issue in the netifrxqcleanupunlease function, responsible for tearing down network queue memory providers, allows a device to perform Direct Memory Access DMA to an incorrect memory address. This occurs because the DMA mappings are...

CVE-2026-64969 Insecure Direct Object Reference in ATutor

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

CVE-2026-76634 WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...

CVE-2026-55519 Snipe-IT: Improper Authorization in File Deletion (IDOR)

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy methods in app/Http/Controllers/Api/UploadedFilesController.php and...

CVE-2026-75951

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

CVE-2026-75951

J-BusinessDirectory extension (versions before 6.2.3) contains an Insecure Direct Object Reference flaw across multiple frontend/API actions, allowing unauthenticated remote attackers to access or modify other users' data; CVSS 6.9 (Medium). Remediation is to upgrade to version 6.2.3 or later. No...

EUVD-2026-62492

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

CVE-2026-72315

A flaw was found in the Linux kernel's SMB client cifs. This issue occurs due to a delayed release of dentry reference counts during direct I/O DIO operations. When a file system is unmounted while these operations are still pending, it can lead to a "busy dentry" warning. This prevents the...

PT-2026-78450

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

CVE-2026-73395 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-73395

The WordPress plugin Booking calendar, Appointment Booking System (versions ≤ 3.2.36) has an unauthenticated IDOR flaw, discovered by Jakub Herman, allowing remote attackers to access or modify objects without authentication. CVSS 3.1 scores 6.5 (Medium) with no in-the-wild exploitation reported....