CVE-2024-10220-githooks

CVE-2024-10220 Test ref https://irsl.medium.com/sneaky-write-hook-git-clone-to-root-on-k8s-node-e38236205d54...

CVE-2026-89548

A flaw was found in the Linux kernel's SUNRPC component. When sunrpcdestroycachedetail is called, it may not properly drain the cachecleaner before freeing a cachedetail object. This oversight can lead to a use-after-free vulnerability, where the system attempts to access or use memory that has...

CVE-2025-47646

CVE-2025-47646 PoC Unauthenticated Privilege Escalation exploit for WordPress PSW Front-end Login Registration Plugin ≤ 1.12 📖 Description This Python script is a proof-of-concept PoC exploit for CVE-2025-47646 , targeting a vulnerability in the WordPress PSW Front-end Login Registration Plugin ≤...

RasmanPotato

RasmanPotato 感谢 @Wh04m1001 一直以来的持续交流 与其他 potato 类似的又一个 potato，利用 RasMan 服务进行权限提升 适用于 Windows 10（未测试 11）、Windows Server 2012 - 2019（未测试 2022） 用法 root@kitploit: magicRasMan v0.1 Provided that the current user has the SeImpersonate privilege, this tool will have an escalation to SYSTEM Arguments: -c...

CVE-2026-89762

A flaw was found in the Linux kernel's AppArmor security module. The begincurrentlabelcritsection function, used in various Linux Security Module LSM hooks, attempts to replace user credentials when a security label becomes stale. This process can lead to a Use-After-Free UAF vulnerability if the...

CVE-2026-89465

A flaw was found in the Linux kernel, specifically within the rt9455 power supply driver. This vulnerability occurs due to improper management of delayed tasks when the device is being removed or if its initialization fails. A pending task can attempt to access memory that has already been...

CVE-2021-3156

CVE-2021-3156 用于 CVE-2021-3156 的 Root shell PoC（无需暴力破解） 仅供教育用途等。 已在 Ubuntu 20.04 上针对 sudo 1.8.31 进行测试。 所有研究归功于：Qualys Research Team 有关详细信息，请查看他们的博客。 您可以使用以下命令检查您的 sudo 版本是否存在漏洞：$ sudoedit -s Y。 如果它要求输入密码，则很可能存在漏洞；如果它打印用法信息，则不存在漏洞。 您可以为了测试目的，使用 $ sudo apt install sudo=1.8.31-1ubuntu1 在 Ubuntu 20.0...

CVE-2026-89610

A flaw was found in the Linux kernel's NTFS component. The mapping pairs decoder fails to verify if a run length extends beyond the volume boundary. A local attacker could exploit this by providing a malformed NTFS image with a crafted mapping pairs array. This could lead to memory corruption and...

CVE-2022-26923_AD-Certificate-Services

CVE-2022-26923 AD 证书服务 发布日期 ：2022年5月10日 攻击复杂度：低 所需权限：低 CVSS 评分： 8.1 该漏洞允许低权限用户在默认的 Active Directory 环境中（安装有 Active Directory 证书服务 AD CS 服务器角色）将权限提升为域管理员。 由 Oliver Lyak ly4k 用 Python 开发了一个利用程序，并在公告发布之前（而非之后）公开。它被声明为概念验证。该利用程序可在 research.ifcr.dk 下载。 来源：...

CVE-2022-0847

CVE-2022-0847 将 dirtypipe 脚本修改为自动提权，无需手动搜索文件来劫持 suid 二进制文件。 编译 gcc dirty.c -o dirty gcc dirtypipe2.c -o dirty 运行 ./dirty 然后你将自动获得 root 权限 修改内容 受影响的内核 内核版本高于 5.8 可能受影响 版本 5.10 版本 5.15 版本 5.16...

CVE-2026-80928

A flaw was found in the Linux kernel's SMACK Simplified Mandatory Access Control Kernel security module. Incorrect handling of task credentials within the smackfilesendsigiotask function can lead to a Use-After-Free UAF vulnerability. A local attacker could exploit this flaw to potentially escala...

CVE-2022-29582-Exploit

CVE-2022-29582 This repository contains exploit code for CVE-2022-29582, a Local Privilege Escalation in iouring of the Linux kernel. Default configurations are affected and no special privileges should be needed. You can find the writeup at...

CVE-2026-89656

A flaw was found in libceph within the Linux kernel. This vulnerability allows a local attacker to craft a malformed CRUSH map, which is used for data placement. By doing so, one data bucket can be made to reuse another bucket's memory workspace, leading to an out-of-bounds write. This memory...

CVE-2026-82329

CVE-2026-82329 — JFrog Artifactory 未认证身份验证绕过（批量利用） -red.svg 严重身份验证绕过（CVSS 9.8）— 已在野外被积极利用 该工具是 CVE-2026-82329 的批量利用 工具，该漏洞允许具有网络访问权限的未认证攻击者 在自托管 JFrog Artifactory 实例上获得完全管理权限 。支持单目标和多线程批量扫描。 ⚠️ 漏洞概述 属性| 值 ---|--- CVE ID| CVE-2026-82329 CVSS 评分| 9.8（严重） CWE| CWE‑287 – 身份验证不当 披露日期| 2026 年 8 月 28 日...

CVE-2026-23111-POC-noddlenpottato

CVE-2026-23111 — noddlenpottato nftables catchall UAF → 非特权 LPE。在大多数 5.10—6.18 Linux 内核上实现从普通用户到 root 的提权。 自动适配目标内核 — 检测结构体偏移、解析符号、查找 ROP gadgets、确定 slab 缓存、生成定制化 exploit、编译并运行。 nftables catchall UAF → 非特权 LPE。在大多数 5.10—6.18 Linux 内核上，普通用户可变为 root。 自动适配目标内核 — 检测结构体偏移、解析符号、查找 ROP gadgets、确定 slab...

CVE-2026-89502

A flaw was found in the Linux kernel's ring-buffer component. When sub-buffers are configured with a specific memory allocation order greater than zero, the system attempts to free a memory page using an incorrect size. This memory management error can lead to memory corruption, potentially...

MegaHiDocker

MegaHiDocker This project will be exploited for some docker containers with similar vulnerability code: CVE-2020-35191, but this time on other containers. = Please read the Description.txt file Requirement: 1.Need to Install docker in your Linux AND Install subprocess module for python 3.X. 2.You...

CVE-2026-89636

A flaw was found in the Linux kernel's Server Message Block SMB client. When the freetgts function frees data structures, a pointer ce-tgthint is not properly reset, leaving it pointing to a memory location that has already been deallocated. If this pointer is subsequently used, it can lead to a...

CVE-2026-80929

A flaw was found in the Linux kernel. A non-root user can exploit a vulnerability in the sysctl mechanism, specifically related to the cadpid entry. By unsharing process ID PID and user namespaces, a local attacker can modify this global system control from a child namespace. This allows a user...

CVE-2026-89750

A flaw was found in the Linux kernel's tracing/userevents component. This vulnerability arises when a child process, created via fork, exits and frees memory that the parent process still references. This creates a Use-After-Free UAF condition, where the parent process attempts to access freed...