CVE-2024-1065

CVE-2024-1065 — PoC de explotación de page cache Exploit de prueba de concepto para CVE-2024-1065, un use-after-free de página física en el driver del kernel de la GPU ARM Mali. El exploit demuestra la explotación de page cache : mediante una condición de carrera, una página MIGRATEMOVABLE libera...

CVE-2017-7921-Writeup-2026

CVE-2017-7921 — Cámara IP / DVR / NVR de Hikvision Autenticación incorrecta — Escalada de privilegios mediante un parámetro de consulta manipulado | ---|--- ID de CVE| CVE-2017-7921 Clase de vulnerabilidad| CWE-287: Autenticación incorrecta Puntuación base CVSS v3.0| 10.0 Crítico —...

cve-2024-4577-lab

Esquema del Entorno root@kitploit: Contenedor del Sistema Operativo: ubuntu:22.04 ejecutándose bajo Windows WSL2. Capa del Servidor Web: Apache2 con modactions, modcgi y modcgid forzados globalmente en el apache2.conf principal. Intérprete de Lenguaje: PHP 8.1.2 ejecutándose estrictamente en modo...

vsftpd-cve-2011-2523-lab

Explotación de la puerta trasera VSFTPD 2.3.4 CVE-2011-2523 Un laboratorio práctico de pruebas de penetración que demuestra la identificación y explotación de la puerta trasera VSFTPD 2.3.4 CVE-2011-2523 en la máquina virtual intencionalmente vulnerable Metasploitable2 utilizando Metasploit...

wp2shell

wp2shell-check Comprobador no intrusivo para CVE-2026-63030 / CVE-2026-60137 "wp2shell", una cadena de ejecución remota de código RCE de preautenticación en el núcleo de WordPress confusión de la ruta batch de la API REST → inyección SQL → RCE. Versiones afectadas: WordPress 6.9.0–6.9.4,...

CVE-2026-43494-PinTheft-PoC

SLEY — PoC de PinTheft CVE-2026-43494 Prueba de concepto — uid=1000raken → uid=0root después de ./sley en WSL2 6.6.87.2-microsoft-standard-WSL2 Prueba de concepto en un solo archivo para CVE-2026-43494 PinTheft: una escalada de privilegios local del kernel de Linux que encadena un error de conteo...

CVE-2026-2472-Vertex-AI-SDK-Google-Cloud

🚨 CVE-2026-2472-Vertex-AI-SDK-Google-Cloud - Herramienta simple de prueba de concepto 🛠 Acerca de esta aplicación Esta herramienta muestra una prueba de concepto PoC técnica para el problema de seguridad CVE-2026-2472. El problema afecta al SDK de Python Vertex AI de Google Cloud Platform. Se...

csf

ArmourBird CSF - Container Security Framework Note: The CSF Client is under active development and is getting converted into GoLang for better performace and architecture Table of Contents 1. About 2. Architecture Diagram 3. APIs-CSF Server 4. Installation/Usage 5. Building Docker Images 6. Sneak...

Qlik-View-12.60-Including-SR-Stored-Cross-Site-Scripting-CVE-2022-42248

QlikView = 12.60 Including SR Stored Cross Site Scripting CVE-2022-42248 Table of Contents 1. Overview 2. Detailed Description 3. Proof of Concept 4. Solution 5. Disclosure Timeline 6. References 7. Credits 8. Legal Notices Overview Revision: 1.0 Impact: Stored cross-site scripting in QlikView Aj...

CVE-2026-43499-A36

CVE-2026-43499-A36 Port independiente de CVE-2026-43499 probado en dispositivo para el Galaxy A36 5G canadiense SM-A366W con el firmware exacto A366WVLS3AYG1, incluida la carga tardía de KernelSU y la integración con Root My Galaxy. Este repositorio contiene la parte nativa específica del...

CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-82681

ash-project ash_admin (Elixir admin panel) contains a query-parameter injection in the Table, DataTable, and Show components. Row-action URLs were built via raw string interpolation of the primary key without URL-encoding. Because the primary key is spliced last into the query string and Plug.Con...

CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

EEF-CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Summary Improper Encoding or Escaping of Output vulnerability in ash-project ash\admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splici...

EUVD-2026-68327

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2024-13869

CVE-2024-13869 Migración, copia de seguridad, staging – WPvivid 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever...

Important: Red Hat Security Advisory: mingw-sqlite security update

An update for mingw-sqlite is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...

Linux-Kernel-Dirty-Pipe-Exploitation-Logic-Bug-

Explotación de Dirty Pipe en el Kernel de Linux Error Lógico por: Antonius w1sdom https://www.bluedragonsec.com https://github.com/bluedragonsecurity Dirty Pipe CVE-2022-0847 es una de las vulnerabilidades de seguridad más significativas en el Kernel de Linux 5.8 – 5.15.24, descubierta por Max...