pax

pax Exploit padding oracles for fun and profit! Pax PAdding oracle eXploiter is a tool for exploiting padding oracles in order to: 1. Obtain plaintext for a given piece of CBC encrypted data. 2. Obtain encrypted bytes for a given piece of plaintext, using the unknown encryption algorithm used by...

CVE-2020-29669

Macally WIFISD2-2A82 Writeup по CVE-2020-29669 от Maximilian Barz Silky и Daniel Schwendner code-byter ========================== Это разбор эксплуатации дорожного маршрутизатора Macally WIFISD2-2A82 версия прошивки: 2.000.010. Гостевой пользователь может сбросить свой собственный пароль. В этом...

CVE-2026-78593

Kibana 's Cribl integration contains an insufficiently validated configuration field that allows an authenticated user with Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template. This results in an Elasticsearch ingest pipeline being writt...

CVE-2026-78593 Improper Control of Generation of Code in Kibana Leading to Privilege Escalation

An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...

CVE-2026-78583 Incorrect Authorization in Kibana Leading to Privilege Escalation

Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Input Data Manipulation CAPEC-153. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding...

EUVD-2026-70657

Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Input Data Manipulation CAPEC-153. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding...

CVE-2026-78583

CVE-2026-78583 is an Incorrect Authorization (CWE-863) vulnerability in Kibana 's Elastic Fleet feature. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents . An attacker holding Fl...

EUVD-2026-66331

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication XPC while masquerading as an Apple-signed process...

CVE-2026-15431 HP Support Assistant – Potential Escalation of Privilege

A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls...

CVE-2026-15431

HP Support Assistant versions prior to 9.53.2.0 contain a local privilege escalation vulnerability caused by insufficient access controls , allowing a local attacker with low privileges (and no user interaction) to compromise the confidentiality, integrity, and availability of the vulnerable syst...

EUVD-2026-70656

A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls...

ipfire-2-25-auth-rce

Ipfire 2-25 core update 156 인증된 RCE 패킷 설치 시 시스템 명령 실행 시스템이 HTML만으로 7zip을 가져옴 그리고 tmp 디렉터리 확인 버전 2.25 - core update 156 ipfire는 로그인 후 nobody 권한으로 임의의 OS 명령 실행을 허용함 루트가 되자! SUID 바이너리 확인 백업 프로그램이 다른 스크립트를 실행함. /var/ipfire/backup/bin/backup.pl bash 스크립트이며 권한이 매우 좋아 보임 bash 스크립트에 쓰기를 시도함. 오류 없음. 좋음!...

CVE-2024-6624

CVE-2024-6624 | JSON API User = 3.9.3 - Неаутентифицированное повышение привилегий Это Python-скрипт, который эксплуатирует уязвимость CVE-2024-6624 в плагине JSON API User = 3.9.3 для WordPress. Этот инструмент позволяет неаутентифицированным атакующим регистрировать новых пользователей и повыша...

EUVD-2026-70652

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit aws-fpga before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path ...

CVE-2026-85028

CVE-2026-85028 affects the FPGA management tool installation component of AWS FPGA Development Kit (aws-fpga) prior to version 2.3.4 . The root cause is the creation of a temporary file in a world-writable directory with insecure permissions. A local attacker with low privileges can place crafted...

CVE-2026-85028 Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit aws-fpga before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path ...

CVE-2025-50168-pwn2own-berlin-2025

Author: D4m0n CVE-2025-50168 Это эксплойт, представленный на Pwn2Own Berlin 2025 — категория LPE. Уязвимость находится в Win32kbase!DirectComposition; более подробную информацию можно найти в блог-посте. Благодарности Техника обхода kASLR: prefetch-tool от carrotc4k3 Особая благодарность: David &...

bofhound

THIS REPO IS NO LONGER ACTIVE ⛔🚧 This repo is no longer maintained. To submit an issue, pull request, or obtain the lastest version, reference https://github.com/coffeegist/bofhound 🚧⛔ root@kitploit: | / / / | /| | | | / \ | | | | | \ | | | \ | | | | | | | | | | || | | | | | | | | | | | | | .--. ...

linux-smart-enumeration

First, a couple of useful oneliners ; root@kitploit: wget "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -O lse.sh;chmod 700 lse.sh root@kitploit: curl "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -Lo...

CVE-2026-31431-copy-fail

Эксплойт CVE-2026-31431 Copy Fail Часть 1: Теоретическая концепция Как работает CVE-2026-31431 Вместо того чтобы система постоянно получала файлы напрямую с медленного физического жёсткого диска — на что уходит много времени, — Linux создаёт временную копию файла в ОЗУ, известную как Page Cache...