WFH

Windows Feature Hunter WFH Windows Feature Hunter WFH est un script Python de preuve de concept qui utilise Frida, un kit d'instrumentation dynamique, pour aider à identifier potentiellement des « vulnérabilités » ou « fonctionnalités » courantes dans les exécutables Windows. WFH a actuellement l...

Chimera

Chimera Unlea$ed Contexte de l'outil Bien que le DLL sideloading puisse être utilisé à des fins légitimes, comme le chargement de bibliothèques nécessaires au fonctionnement d'un programme, il peut également être utilisé à des fins malveillantes. Les attaquants peuvent utiliser le DLL sideloading...

CVE-2025-21420-PoC

CVE-2025-21420 PoC Vulnérabilité d'élévation de privilèges de l'outil de nettoyage de disque de Windows À ma connaissance, bien qu'incomplet, il s'agit du premier PoC pour cette CVE. https://nvd.nist.gov/vuln/detail/CVE-2025-21420 https://vulners.com/cve/CVE-2025-21420 Nous avons trouvé un moyen ...

CVE-2026-3796

CVE-2026-3796 Dans QAX Virus Removal version datée du 2025-10-22 et antérieure, le pilote concerné QKSecureIOImp.sys s'appuie sur l'image du processus appelant pour déterminer s'il est autorisé à communiquer avec le pilote mini-filtre. Les attaquants pourraient usurper l'image d'un processus...

NimDllSideload

Nim DLL Sideloading Этот репозиторий позволяет легко генерировать DLL-библиотеки на Nim, которые можно использовать для sideloading/прокси-загрузки. Если вы не знакомы с тем, что такое DLL sideloading, загляните в этот пост в блоге. Как этим пользоваться? Поместите легитимную DLL или несколько DL...

OneDriveUpdaterSideloading

Sideloading de DLL OneDriveUpdater Ce dépôt contient le code source pour le sideloading de la DLL version.dll pour OneDriveUpdater.exe/OneDriveStandaloneUpdater.exe. La charge utile est basée sur les sous-routines décrites dans le billet de blog de PaloAltoNetworks Unit42. Mon billet de blog à...

CVE-2026-59781

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...

CVE-2026-59781 Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...

CVE-2026-59781

The Zabbix Agent Windows installer did not validate directory permissions during custom-path installation, allowing attackers to drop a malicious DLL that gets loaded by the agent, enabling arbitrary code execution. The fix detects unsafe directories and requires explicit user confirmation before...

EUVD-2026-60742

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...

PT-2026-76964

Name of the Vulnerable Software and Affected Versions Zabbix Agent affected versions not specified Description When installed on Windows in a custom directory, the installer fails to verify if the selected location has secure access permissions. This allows an attacker to place a malicious DLL in...

Signed, sealed, injected: The mechanics of DCRat in 2026

Signed, sealed, injected: The mechanics of DCRat in 2026 By Madhini Muralidharan, Shalaka Patil and Kaushal Sarda · August 13, 2026 Introduction In early 2026, the Trellix Advanced Research Center ARC identified and analyzed an active DarkCrystal RAT DCRat campaign following a critical customer...

Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT

A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance teams to deliver a remote access trojan designed to steal sensitive data from compromised hosts. The multi-stage campaign, codenamed Operation DragonReturn by...

Windows-privilege-exploits

Elevation !Windowshttps://img.shields.io/badge/platform-Wi...

CVE-2026-33156

ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32...

CVE-2026-33156 DLL Sideloading in ScreenToGif

ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32...

CVE-2026-33156

CVE-2026-33156 affects ScreenToGif (portable versions up to 2.42.1). The flaw is DLL sideloading through version.dll: when run from a user-writable directory, the executable loads version.dll from its own directory instead of Windows System32, enabling arbitrary code execution in the user’s conte...

Hackers Use LinkedIn Messages to Spread RAT Malware Through DLL Sideloading

Cybersecurity researchers have uncovered a new phishing campaign that exploits social media private messages to propagate malicious payloads, likely with the intent to deploy a remote access trojan RAT. The activity delivers "weaponized files via Dynamic Link Library DLL sideloading, combined wit...

CVE-2022-23748

mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files...

CVE-2021-31841

A DLL sideloading vulnerability in McAfee Agent for Windows prior to 5.7.4 could allow a local user to perform a DLL sideloading attack with an unsigned DLL with a specific name and in a specific location. This would result in the user gaining elevated permissions and the ability to execute...