tomcat-cve-2025-24813-lab

Apache Tomcat CVE-2025-24813 本地复现记录 仅用于本地授权实验、补丁理解和防守验证。请勿对未授权目标发送请求。 本项目记录在 Apache Tomcat 9.0.98 本地实例上对 CVE-2025-24813 的复现过程：使用 partial PUT 写入临时文件，在启用文件型 Session 持久化且反序列化过滤条件宽松的配置下，验证 Session 文件加载及 Payload 执行链路。 结论摘要 测试版本：Apache Tomcat 9.0.98（截图与本地实验记录） 修复版本：Apache Tomcat 9.0.99 关键前提：Default...

CVE-2025-2783

CVE-2025-2783 CVE-2025-2783 的模拟 PoC——Chrome 的 Mojo IPC 中的沙箱逃逸漏洞。包括钓鱼投递、内存模糊测试、IPC 模拟和日志记录。适用于红队演示、检测工程和教育用途。 本项目模拟了 CVE-2025-2783 的一个安全且具有教育意义的概念验证，该漏洞存在于 Google Chrome 的 Mojo IPC 框架中，允许在 Windows 系统上实现沙箱逃逸和本地代码执行。 ⚠️ 这不是真正的漏洞利用 。这是一个模拟演示 ，仅用于教育、红队演练和检测工程培训目的。 🚀 功能特性 🕵️ 沙箱检测（通过 ctypes） 🐍 使用 Python...

CVE-2019-1064

CVE-2019-1064 - AppXSVC Local Privilege Escalation https://www.rythmstick.net/posts/cve-2019-1064/...

CVE-2025-56503

CVE-2025-56503 Descripción Un problema en Sublime HQ Pty Ltd Sublime Text 4 4200 permite a atacantes autenticados con privilegios de bajo nivel escalar privilegios a Administrador mediante el reemplazo del archivo de desinstalación por un binario manipulado en la carpeta de instalación. Producto...

CVE-2026-12243-NLTK-PoC

CVE-2026-12243 — Laboratorio de Path Traversal en NLTK Un laboratorio Docker pequeño y reproducible que contrasta el comportamiento de path traversal con codificación porcentual en NLTK 3.9.4 con el comportamiento corregido en NLTK 3.10.0. La versión vulnerable valida el nombre del recurso antes ...

CVE-2018-8440

CVE-2018-8440 Desde que noté que metasploit está usando la dll proporcionada por SandboxEscaper y solo tiene un objetivo para x64, decidí compartir mi poc con la comunidad. Por supuesto, hay vectores mucho mejores que apuntar a la cola de impresión, pero lo dejaré como ejercicio para el lector...

CVE-2024-1086

CVE-2024-1086 针对 CVE-2024-1086 的通用本地权限提升概念验证漏洞利用，适用于大多数介于 v5.14 至 v6.6 之间的 Linux 内核，包括 Debian、Ubuntu 和 KernelCTF。在 KernelCTF 镜像中成功率为 99.4%。 https://github.com/Notselwyn/CVE-2024-1086/assets/68616630/a3d43951-94ab-4c09-a14b-07b81f89b3de 博客文章 / 详细分析 漏洞的完整分析——包括背景信息和大量有用的图表——可以在 Flipping Pages 博客文章...

CVE-2017-8869

CVE-2017-8869 - MediaCoder 0.8.48.5888 - Desbordamiento de búfer local SEH Exploit reescrito con opción de shell inversa...

CVE-2026-64468

CVE-2026-64468 — Use-after-free de por vida del proceso en binderfreetransaction del kernel Linux Este repositorio contiene, para el use-after-free de Binder del kernel Linux corregido por el commit upstream f223d27a546c1e1f48d38fd67760e78f068fe8c4: binderchain64468.c — una prueba de concepto sin...

CVE-2026-100547

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions 2026.7.1 through 2026.7.2, alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

CVE-2026-100538

OpenClaw npm package 'openclaw' before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling outbound attachments. A sender that has been explicitly denied filesystem read tools can still cause a known local file to be read and returned via a...

CVE-2026-100526

OpenClaw's Discord integration npm package @openclaw/discord before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same...

CVE-2025-32463-EXPLOIT

CVE-2025-32463 - Escalada de privilegios en Sudo Existe una vulnerabilidad de escalada de privilegios en sudo que afecta a sistemas basados en Linux/Unix. El fallo surge debido a una validación incorrecta de rutas cuando sudo se utiliza con la opción -R --chroot, lo que permite a los atacantes...

ansible_CVE-2016-5195_check

Description Playbook for testing the dirty cow vulnerability CVE-2016-5195. Dependencies local user on the system with sudo priveleges Run ansible-playbook -i host, check.yml -u jondoe -k -K Links http://dirtycow.ninja...

CVE-2024-9264

CVE-2024-9264 - PoC de LFI/RCE en Grafana SQL Expressions DuckDB Prueba de concepto en Python para CVE-2024-9264, una vulnerabilidad de Grafana SQL Expressions que puede permitir la inclusión autenticada de archivos locales y la ejecución de comandos cuando duckdb está disponible en el PATH del...

EUVD-2026-87454

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

CVE-2026-100547

The OpenClaw coding agent (npm package openclaw) versions 2026.7.1 through 2026.7.2 are vulnerable to a local file disclosure flaw. The root cause is that alternate but valid file: URL spellings supplied over the Agent Client Protocol (ACP) are incorrectly treated as relative paths and classified...

EUVD-2026-87503

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions 2026.7.1 through 2026.7.2, alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

CVE-2026-100547 OpenClaw before 2026.8.1 Authentication Bypass via File URL

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions 2026.7.1 through 2026.7.2, alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

CVE-2026-100538 OpenClaw before 2026.8.1 Local File Read via Outbound Attachments

OpenClaw npm package 'openclaw' before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling outbound attachments. A sender that has been explicitly denied filesystem read tools can still cause a known local file to be read and returned via a...