CVE-2017-7494

Exploit SambaCry CVE-2017-7494 CVE-2017-7494/SambaCry permite a usuarios autenticados subir una biblioteca compartida a una carpeta escribible y realizar un ataque de ejecución utilizando las bibliotecas subidas. Explicación de la vulnerabilidad SambaCry es una vulnerabilidad de validación de rut...

cve-2026-6471-postgres-logical-decoding-dlopen

PostgreSQL CVE-2026-6471: decodificación lógica dlopen de una biblioteca arbitraria La decodificación lógica de PostgreSQL permite que un rol que no es superusuario y que posee el privilegio REPLICATION cree un slot de replicación lógica y elija el plugin de salida. En las versiones afectadas no...

linux_injector

linuxinjector Un sencillo inyector de bibliotecas compartidas sin ptrace para Linux x64. Uso linuxinjector mode 1. dlopen normal 2. memfd + dlopen para inyectar en contenedores 3. shellcode crudo pid ID del proceso objetivo. Debe tener derechos de ptrace sobre él requerido para acceder a...

CVE-2021-27928

CVE-2021-27928 在本仓库中，你将找到通过一个 docker 容器利用 CVE-2021-27928 漏洞的概念验证代码。 Exploit Title: MariaDB 10.2 /MySQL - 'wsrepprovider' OS Command Execution Date: 03/18/2021 Exploit Author: Central InfoSec Version: MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, 10.5 before 10.5.9; Percon...

CVE-2025-32463_exploit

CVE-2025-32463 — sudo "chwoot" chroot: escalada local de privilegios Escalada local de privilegios a root en sudo mediante la opción --chroot -R. Funciona para cualquier usuario local , incluidas cuentas sin ninguna entrada en sudoers p. ej. www-data. sudo 1.9.14 – 1.9.17 hace chroot al directori...

Rocky Linux 9 [CIQ] Security Update: glibc / glibc-all-langpacks / glibc-benchtests / etc (crlsa-2025_8655)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258655 advisory. glibc: static setuid binary dlopen may incorrectly search LDLIBRARYPATH CVE-2025-4802 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: evince / evince-debuginfo / evince-debugsource / evince-libs / etc (crlsa-2026_27819)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202627819 advisory. atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen CVE-2026-46529 Tenable has extracted the preceding...

Rocky Linux 8 [CIQ] Security Update: compat-libpthread-nonshared / glibc / glibc-all-langpacks / etc (crlsa-2025_8686)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258686 advisory. glibc: static setuid binary dlopen may incorrectly search LDLIBRARYPATH CVE-2025-4802 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: evince / evince-browser-plugin / evince-browser-plugin-debuginfo / etc (crlsa-2026_28998)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202628998 advisory. atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen CVE-2026-46529 Tenable has extracted the preceding...

CVE-2026-46529

通过PDF argv注入实现RCE CVE-2026-46529 atril/xreader/evince evspawn shell/ev-application.c 中 argv 注入的有效概念验证。在精心构造的PDF渲染页面上任意位置单击一次，即可利用运行查看器的用户权限执行任意代码。 此版本使用%f替换技术：dlopen目标路径由查看器本身在运行时发现，因此攻击者无需知道多格式文件在受害者文件系统中的任何位置（无需用户名、无需$HOME、无需下载目录）。 POC...

CVE-2026-47630

CVE-2026-47630 — NVIDIA Triton Inference Server: dlopen arbitrario mediante TRITONBATCHSTRATEGYPATH Recorrido de ruta absoluta en el cargador personalizado de estrategias de batching de triton-inference-server/core. Un parámetro de configuración del modelo se pasa sin validar a dlopenRTLDNOW |...

CVE-2025-4802-Proof-of-Concept

CVE-2025-4802 — Prueba de Concepto ⚠️ Aviso legal: Este repositorio es para fines educativos y de investigación de seguridad autorizada únicamente. No utilice este exploit contra sistemas que no posea o para los que no tenga permiso explícito de prueba. El uso indebido puede violar leyes y...

CVE-2026-79919 MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LDPRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen call-stack heuristic sees a Python import frame, then use unhooked dlsym...

CVE-2026-79919 MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LDPRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen call-stack heuristic sees a Python import frame, then use unhooked dlsym...

CVE-2026-79919

MaxKB , an open-source enterprise AI assistant, has a sandbox-escape vulnerability in its function-library code prior to version 2.10.6-lts . Attackers can bypass the LD_PRELOAD sandbox by invoking ctypes.CDLL from an importlib.abc.MetaPathFinder callback—causing the dlopen call-stack heuristic t...

CVE-2025-4802-Proof-of-Concept

CVE-2025-4802 — Prueba de Concepto ⚠️ Aviso: Este repositorio es solo para fines educativos y de investigación de seguridad autorizados. No use este exploit contra sistemas que no posea o para los que no tenga permiso explícito para probar. El uso indebido puede violar leyes y regulaciones. Resume...

CVE-2026-79919: Protection Mechanism Failure

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LDPRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen call-stack heuristic sees a Python import frame, then use unhooked dlsym...

leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins

A privilege escalation flaw was found in the scanmysql actor of leapp-upgrade-el9toel10 provided by leapp-repository. During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL syste...

CVE-2026-75092

A privilege escalation flaw was found in the scanmysql actor of leapp-upgrade-el9toel10 provided by leapp-repository. During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL syste...

PT-2026-91894

A privilege escalation flaw was found in the scan mysql actor of leapp-upgrade-el9toel10 provided by leapp-repository. During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL...