exrop

Exrop Automatic ROP chain generator for x86-64 binaries, powered by Triton symbolic execution. Features Set registers to constants or other registers rdi=0x41414141, rdi=rax Write to memory constant and register-based addresses/values Write strings/bytes to memory Function calls with mixed...

CVE-2025-7771

CVE-2025-7771 通过滥用 ThrottleStop 驱动程序，从用户模式调用任意内核模式函数的漏洞利用程序。 演示 参考 https://github.com/jonomango/superfetch https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/...

peach

Peach Fuzz - Vulnerability Scanning Framework This tool aims to look through files in a given directory to detect any unsafe, vulnerable, or dangerous function calls. It is designed to be extensible and easy to understand; you can "plug-and-play" modules that specify criteria on which types of...

EUVD-2026-85368

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters...

CVE-2026-96654

Plex Media Server versions prior to 1.43.3.10861 are vulnerable to a URL injection flaw. The software fails to correctly neutralize URL values within the 'searchOne' parameter, which enables an attacker to call functions from other plugins and provide their own parameters. While the documents do ...

MSRKit

MSRKit Una herramienta para llamar funciones del kernel y mapear controladores mediante una cadena ROP a través de una primitiva wrmsr en un controlador vulnerable AmdTools64.sys. Cómo funciona 1. Carga AmdTools64.sys mediante NtLoadDriver recurre a PnP devnode + interfaz de dispositivo basada en...

CVE-2026-88856

OrdaSoft Joomla Gallery extension for Joomla versions

x64dbg-xfg-marker

Complemento XFG Marker para x64dbg Microsoft eXtended Flow Guard XFG es una técnica de integridad de flujo de control CFI que extiende CFG con firmas de llamada a funciones. Cada firma tiene 8 bytes de longitud y se encuentra justo antes de la función de destino. Dado que la firma se encuentra en...

PT-2026-93277

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Memory leaks have been fixed in checkfunccall. kmemleak reports this issue: Unreferenced object 0xffff88817139d000 size 2048: comm "testprogs", pid 33246, jiffies 4307381979 age 45851.820s Hex dump first 32 bytes: 01 00 0...

CVE-2026-16759

Tutor LMS (eLearning plugin for WordPress, versions ≤ 4.0.5 ) is vulnerable to unauthenticated Remote Code Execution limited to zero-argument function invocation via the tutor_course_filter_ajax AJAX action. The root cause is a missing authorization check combined with unsanitized array keys pass...

PT-2026-82860

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor course filter ajax AJAX action. This is due to missing authorization on the handl...

CVE-2026-19092 Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...

PT-2026-82654

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6 Description The Tutor LMS WordPress plugin contains a template injection issue caused by insufficient validation of request data. This allows unauthenticated users to overwrite internal variables during templa...

EUVD-2026-64925

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102078)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102078 advisory. In the Linux kernel, the following vulnerability has been resolved: pmdomain: core: Fix detach procedure for virtual devices in genpd If a device is attached to a PM...

SPIP X-Spip-Filtre Unauthenticated RCE

This module exploits a PHP function-call injection in SPIP's template engine. The analyseresultatskel function extracts patterns from the rendered page body and calls the listed functions as template filters. A newline character is injected into a GET parameter value, which places a header call o...

CVE-2026-14680

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for...

GHSA-H784-HPJP-2RRM Duplicate Advisory: Craft CMS: Authenticated RCE through Twig sandbox escape

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f5wm-88jv-g5hx. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution...

EUVD-2026-50115

The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...