CVE-2021-3560

Polkit D-Bus Authentication Bypass Exploit A vulnerability exists within the polkit system service that can be leveraged by a local, unprivileged attacker to perform privileged operations. In order to leverage the vulnerability, the attacker invokes a method over D-Bus and kills the client proces...

Windows-WinSock-UAF-Mitigation

CVE-2026-68820: Windows WinSock afd.sys UAF Mitigation This repository contains a conceptual patch demonstrating the mitigation for CVE-2026-68820 , a critical Use-After-Free UAF vulnerability in the Windows Ancillary Function Driver for WinSock afd.sys. Active exploitation of this flaw allows a...

CVE-2023-43341-Evolution-Reflected-XSS---Installation-Connection-

Evolution CMS Reflected XSS v3.2.3 Author: Sergio Description: A cross-site scripting XSS reflected vulnerability in the evolution v.3.2.3 installation process connection allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the uid parameter. Attack Vectors...

CVE-2023-43871-WBCE-Arbitrary-File-Upload--XSS---Media

WBCE File Upload XSS - WBCE v1.6.1 Author: Sergio Description: File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden XSS. Attack Vectors: A vulnerability in Media file upload sanitation allows you to upload a PDF file with hidden XSS. POC: When logging...

CVE-2023-1326-PoC

CVE-2023-1326-PoC A proof of concept for CVE-2023–1326 in apport-cli 2.26.0 This vulnerability is privilege escalation in apport-cli 2.26.0, similar to CVE-2023–26604, this vulnerability only works if assign in sudoers: A privilege escalation attack was found in apport-cli 2.26.0 and earlier whic...

CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles in the Extensions - MicroTiny WYSIWYG editor. Attack Vectors: Scripting A vulnerability ...

CVE-2023-44761_ConcreteCMS-Stored-XSS---Forms

ConcreteCMS Stored XSS v.9.2.1 Author: Sergio Description: Multiple Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects. Attack Vectors: Scripting A vulnerability in the sanitization of t...

CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title in the My Preferences - Manage Shortcuts Attack Vectors: Scripting A vulnerability in the...

CVE-2023-44762_ConcreteCMS-Reflected-XSS---Tags

ConcreteCMS Reflected XSS v.9.2.1 Author: Sergio Description: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags. Attack Vectors: Scripting a vulnerability in the sanitization of the ent...

CVE-2023-44765_ConcreteCMS-Stored-XSS---Associations

ConcreteCMS XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings. Attack Vectors: Scripting A vulnerability in the...

CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Extra in the Content - News Menu. Attack Vectors: Scripting A vulnerability in the sanitization o...

CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory in the File Picker Menu. Attack Vectors: Scripting A vulnerability in the...

CVE-2023-43342-Quick-CMS-Stored-XSS---Languages-Frontend

Quick CMS Stored XSS v6.7 Author: Sergio Description: A Cross-Site Scripting XSS vulnerability in Quick CMS v6.7 allows a local attacker to execute arbitrary code via a crafted script to the to the Front and back end - Pages in the Languages Menu. Attack Vectors: Scripting A vulnerability in the...

CVE-2023-44764_ConcreteCMS-Stored-XSS---Site_Installation

ConcreteCMS Stored XSS v.9.2.1 Author: Sergio Description: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the SITE parameter from installation or in the Settings. Attack Vectors: Scripting A vulnerability in the...

CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Multiple cross-site scripting XSS vulnerabilites in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data in the Content Manager Menu. Attack Vectors:...

CVE-2023-43343-Quick-CMS-Stored-XSS---Pages-Files

Quick CMS Stored XSS v6.7 Author: Sergio Description: Multiple Cross-Site Scripting XSS vulnerabilities in Quick CMS v6.7 allows a local attacker to execute arbitrary code via a crafted script to the to the Files - Description in the Pages Menu. Attack Vectors: Scripting A vulnerability in the...

CVE-2023-42829

CVE-2023-42829; 'An app may be able to access SSH passphrases' This document presents both an analysis of a logic vulnerability identified in the ssh binary on macOS my first software vulnerability!, and a patch analysis demonstrating how Apple fixed the vulnerability. I reported the issue Apple...

Dirty-Pipe-Exploits

CVE-2022-0847 Exploits Dirty Pipe What is it ? Disclosed on March 7, 2022 by Max Kellerman2, CVE-2022-0847 is a vulnerability in the Linux kernel versions 5.8 to 5.16.11 that allows attackers to overwrite read-only or immutable files and escalate their privileges on the victim's system...

Smart s200 Management Platform v.S200 - SQL Injection

SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information and escalate privileges via the /importexport.php component. id: CVE-2024-27718 info: name: Smart s200 Management Platform v.S200 - SQL Injection author:...

CVE-2024-55511

CVE-2024-55511 This repository has been archived and moved here A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially elevate their privileges via executing a specially crafted executable. I am currently creati...