CVE-2021-3560

Polkit D-Bus 认证绕过漏洞利用 Polkit 系统服务中存在一个漏洞，本地非特权攻击者可以利用它执行特权操作。为了利用该漏洞，攻击者通过 D-Bus 调用一个方法，然后终止客户端进程。这有时会导致操作完成时未经过所有必要的认证。该漏洞利用模块利用此漏洞添加一个具有 sudo 访问权限和已知密码的新用户。然后利用该新账户以 root 权限执行 payload。...

CVE-2021-3560

CVE-2021-3560 - Escalada de Privilegios Local de Polkit ⚠️ Solo con fines educativos y de investigación de seguridad autorizada Autores del Exploit Original Muy agradecidos al autor original del PoC @UNICORDev por @NicPWNs y @Dev-Yeoj Descripción Se descubrió que se podía engañar a polkit para que...

CVE-2021-36808

CVE-2021-36808 本地攻击者可通过竞争条件绕过 Sophos Secure Workspace for Android 9.7.3115 之前版本的应用密码。 安全公告： https://www.sophos.com/en-us/security-advisories/sophos-sa-20211029-ssw-pw-bypass 详细分析： https://ctulhu.me/posts/sophos-secure-workspace-app-password-bypass/...

CoD-MW-Warzone-2---CVE-2023-38821

CoD-MW-Warzone-2 - CVE-2023-38821 DLL Planting en CoD MW Warzone 2 - CVE-2023-38821 Descubridor: Idan Malihi Descripción Un problema en Activision Call of Duty Modern Warfare: Warzone v.2 permite a un atacante local ejecutar código arbitrario a través de un archivo manipulado dirigido a los...

CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut

CMSmadesimple 存储型XSS v2.2.18 作者: Sergio 描述: CMSmadesimple v.2.2.18 中存在跨站脚本漏洞，允许本地攻击者通过在"我的偏好 - 管理快捷方式"中的标题字段注入恶意脚本执行任意代码。 攻击向量: 脚本注入。在"我的偏好 - 管理快捷方式"标题字段的过滤处理存在漏洞，允许注入JavaScript代码，当用户访问网页时将执行该代码。 POC: 登录后台后，我们将从通用菜单进入"我的偏好 - 管理快捷方式"部分。 我们编辑"内容 - 新闻"菜单，使用我们创建的payload，可以看到我们能够在标题字段中注入任意JavaScript代码...

CVE-2024-22734

CVE-2024-22734 CVE-2024-22734 漏洞利用 PoC 此仓库包含 CVE-2024-22734 漏洞的 Proof of Concept PoC 利用源码，该漏洞由 Redline Cyber Security 的 Bryan Smith 发现。有关该漏洞的详细信息，请参阅我们的博客文章：CVE-2024-22734：漏洞利用 PoC 详解。 漏洞概述 CVE-2024-22734 是一个影响 AMCS Trux Software https://www.amcsgroup.com/solutions/enterprise-management/trux/...

CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension

CMSmadesimple 存储型XSS漏洞 v2.2.18 作者：Sergio 描述： CMSmadesimple v.2.2.18 中存在跨站脚本漏洞，本地攻击者可通过文件选择器菜单中的顶部目录字段注入恶意脚本，从而执行任意代码。 攻击向量： 脚本注入漏洞。文件选择器菜单中“顶部目录”字段的输入过滤不严，允许注入JavaScript代码，当用户访问网页时该代码将被执行。 漏洞利用演示（POC）： 登录后台后，我们进入常规菜单下的“文件选择器扩展 - 顶部目录”部分。 编辑我们已创建的顶部目录菜单，可以看到可以在全局元数据字段中注入任意JavaScript代码。 XSS Payload...

CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra

CMSmadesimple 存储型XSS v2.2.18 作者：Sergio 描述： CMSmadesimple v.2.2.18 中的跨站脚本漏洞允许本地攻击者通过在“内容 - 新闻菜单”的 Extra 中注入精心构造的脚本来执行任意代码。 攻击向量： 对“内容 - 新闻菜单”的 Extra 输入进行过滤的漏洞，允许注入 JavaScript 代码，当用户访问网页时会被执行。 POC： 登录面板后，我们进入主菜单的“内容 - 新闻”部分。 我们编辑该“内容 - 新闻菜单”，使用我们创建的 payload，可以看到我们可以在 Extra 字段中注入任意 JavaScript 代码。 XS...

CVE-2023-44762_ConcreteCMS-Reflected-XSS---Tags

ConcreteCMS 反射型XSS v.9.2.1 作者: Sergio 描述: ConcreteCMS v.9.2.1 中存在跨站脚本漏洞，允许本地攻击者通过向"设置 - 标签"中的标签字段注入特制脚本来执行任意代码。 攻击向量: "设置 - 标签"中标签输入清理机制存在漏洞，允许注入JavaScript代码，当用户访问网页时这些代码将被执行。 概念验证: 登录面板后，我们将进入"仪表盘菜单中的设置 - 标签"部分。 XSS 载荷: root@kitploit: 在下图中，你可以看到嵌入的代码，该代码在主网页中执行载荷。 附加信息:...

Windows-WinSock-UAF-Mitigation

CVE-2026-68820: Mitigación de UAF en Windows WinSock afd.sys Este repositorio contiene un parche conceptual que demuestra la mitigación para CVE-2026-68820 , una vulnerabilidad crítica de Use-After-Free UAF en el controlador de función auxiliar de Windows para WinSock afd.sys. La explotación acti...

CVE-2026-89627

A flaw was found in the Linux kernel's HID Human Interface Device roccat driver. When a roccat device is destroyed, the driver fails to properly free buffered reports, leading to a memory leak. A local attacker could potentially exploit this to exhaust system memory, resulting in a Denial of...

CVE-2026-81011

A flaw was found in the Linux kernel's hp-bioscfg module. The module's package parsers incorrectly determine the number of elements in a package, using a value derived from a name string rather than the true package size. While currently prevented by existing validation, a future change to the...

CVE-2026-89452

A flaw was found in the iommu/msm component of the Linux kernel. This vulnerability occurs when msmiommuprobe fails to properly unwind its probe state during registration, leaving a dangling list entry. A local attacker could potentially exploit this to cause a dereference of the dangling list...

CVE-2026-80972

A flaw was found in the ALSA Advanced Linux Sound Architecture aloop driver within the Linux kernel. This vulnerability arises from insufficient validation of the card index during device setup, specifically when a device is manually configured using the sysfs interface. A local attacker could...

CVE-2026-89641

A flaw was found in the Linux kernel's Common Internet File System CIFS module. This vulnerability, a use-after-free, occurs in the cifsfilesetsize function. When a file's size is being modified, a critical system resource tcon object can be released too early but then accessed again. A local...

CVE-2026-80974

A flaw was found in the mfd: sm501 component of the Linux kernel. This vulnerability arises from a failure to properly free allocated memory for struct sm501devdata during the device removal process. A local attacker could potentially exploit this memory leak, which may lead to a denial of servic...

CVE-2026-89491

A flaw was found in the Linux kernel's ocfs2 cluster module. This vulnerability allows a local attacker to trigger a denial of service. The issue arises when a sleeping function is called while a spinlock is held within the o2hbregionpin function, which can lead to a system crash or deadlock. Thi...

CVE-2026-89443

A flaw was found in the Linux kernel's platform/x86 ISST module. The isstifgetperflevelmask and isstifgetbasefreqmask functions fail to validate a user-provided 'level' parameter. A local attacker could exploit this by providing an invalid 'level' value, leading to an out-of-bounds read from the...

CVE-2026-81017

A flaw was found in the Linux kernel's sensorhub component. A local attacker could provide a maliciously crafted sensor number in an EC FIFO event. This unchecked sensor number could lead to an out-of-bounds read and write in the batchstate array, potentially causing memory corruption or system...

CVE-2026-89615

A flaw was found in the Linux kernel's NTFS3 file system driver. A local attacker could exploit this by providing a specially crafted log record. This crafted record causes a buffer overflow in the pagelcns array, leading to memory corruption within an otherwise valid entry...