CVE-2026-68398

CVE-2026-68398: Ubuntu PPPoL2TP use-after-free to local root This repository contains a build-specific local privilege-escalation exploit for CVE-2026-68398 , a use-after-free race between PPPoL2TP receive processing and destruction of an unattached PPP channel. It was validated in QEMU against t...

ls-poc

CVE-2026-30368 Proof of concept !IMPORTANT This is patched and now requires credentials, use the workaround to perform actions on yourself. Introduction CVE-2026-30368 allows an attacker to control student devices via a weak authentication flaw in Lightspeed Classroom management. The POC poc.js...

alibi

alibi Cross-check the views of your attack surface and find the endpoints that cannot corroborate each other. An endpoint should be able to account for itself. It is in the code, so a contract should describe it. It is in the contract, so something should implement it. It takes real traffic, so i...

CVE-2022-22629

CVE-2022-22629 Proof of concept This post is about the poc for the WebGL bug that was patched in Safari 15.4 security updates. If you want to learn in detail about how WebGL works, you can use this official resource since we are going to discuss bug specific details here :...

CVE-2025-32463

CVE-2025-32463 Local Privilege Escalation to Root via Sudo chroot in Linux. What's This? For the news, you can read here: https://www.helpnetsecurity.com/2025/07/01/sudo-local-privilege-escalation-vulnerabilities-fixed-cve-2025-32462-cve-2025-32463/ TL;DR and CMIIW So, sudo is a command to run a...

geo-sleuth

🧭 geo-sleuth An agent skill that finds where a photo was taken — and shows its work. Works with …and any other agent that reads SKILL.md and runs shell commands. !From one photo to a camera position: the photo, the region scan, the skyline overlays, the evidence...

CVE-2023-33733

CODE INJECTION VULNERABILITY IN REPORTLAB PYTHON LIBRARY tl;dr This write-up details how an RCE in Reportlab - was found and exploited. Due to the prevalence of Reportlab in HTML to PDF processing, this vulnerability may be reachable in many applications that process PDF files, making this an...

CVE-2022-22963

CVE-2022-22963 In versions 3.1.6, 3.2.2, and earlier versions of Spring Cloud Function, when using the routing functionality, it is possible for a user to provide a specially crafted SpEL as a routing expression that can result in remote code execution and access to local resources. PoC Clone the...

CVE-2019-3396

CVE-2019-3396 🔎 Key Information: Affected Product : Confluence Server & Data Center Affected Versions : from 6.0.0 to 6.15.4 Severity : Critical CVSS 9.8 Cause : Confluence has a Widget Connector plugin used to embed videos, external content like YouTube, Vimeo.... This function does not properly...

FLAIR

F-Secure Lightweight Acquisition for Incident Response FLAIR This document describes the purpose and basic operation of the FLAIR acquisition script. Purpose During investigation of incidents on client estate, there are occasions where no EDR deployed which the IR team can make use of to collect...

Writeups

Writeups Collection of detailed and optimized? write-ups for various CTF challenges. Challenge Name| Category| CTF Competition| Short Description ---|---|---|--- The wilderness| pwn| openECSC 2024| Breaking ASLR by timing memory access😈 Lua.efi| pwn| UIUCTF 2025| Booting an unsigned kernel using...

ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM Leak New vulnerability allowing to leak NTLM hashes from browsers with one click By Ruben Enkaoua Description The Microsoft ms-photos URI scheme takes fileName as parameter, which can be submitted with a UNC path, leaking NTLMv2-SSP hashes one opened. By crafting a...

CVE-2026-47103-python-statemachine-rce

CVE-2026-47103: Python StateMachine Remote Code Execution via SCXML eval Injection Severity: Critical, CVSS 4.0 9.3 , CVSS 3.1 9.8 assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...

Trespasser

CVE-2026-74970 · Firefox Fission site-isolation bypass via missing PipelineId namespace check This directory holds an honest reproduction scaffold for a Fission site-isolation authorization bypass in Firefox WebRender. Under Fission each content process owns a distinct PipelineId namespace, but t...

POC-CVE-2018-25031

CVE-2018-25031 - Swagger UI before 4.1.3 A simple POC CVE-2018-25031 that tricks the victim into entering the authorization code, which is then sent to the attacker. You can use it with the XSS Vulnerability https://github.com/VictorNS69/swagger-ui-xss It is necessary to find the parameter and...

CVE-2017-16245

CVE-2017-16245 Source code for CVE-2017-16245 Avecto Defendpoint bypass originally disclosed by Nettitude The PowerShell implementation of CVE-2017-16245 can and should be copied and pasted straight into PowerShell. If PowerShell is blocked, try to execute powershell.exe from the command prompt...

CVE-2023-30226

CVE-2023-30226 Rizin is a reverse engineering framework forked from radare2, a flaw was discovered in its ELF parser code that would allow for a crafted file to perform a denial of service. This would prevent a user from being able to load the file into rizin but still hold no impact on the...

F5-Big-IP-CVE-2022-1388

F5-Big-IP-CVE-2022-1388 CVE-2022-1388 F5 Big IP unauth remote code execution PoC Follow us Vulnmachines YouTube Twitter Facebook LinkedIn...

CVE-2019-2729

CVE-2019-2729 Exploit code for CVE-2019-2729 Oracle Weblogic running on Windows. Can create a callback to a CobaltStrike listener or a Metasploit handler with payload windows/meterpreter/reversetcp Also have a non-beacon exploit that just executes commands on the underlying host. exploit.py. This...

testing-handbook

Trail of Bits Testing Handbook The Trail of Bits Testing Handbook is a resource for developers and security professionals on configuring, optimizing, and automating many static and dynamic analysis tools we use at Trail of Bits. Preview Testing Handbook: https://appsec.guide 🌐 Why is this needed?...