CVE-2020-12112

CVE-2020-12112 🚨 BigBlueButton versions lower than 2.2.4 have a LFI vulnerability allowing access to sensitive files. Story 📜 During a distance learning course on a BigBlueButton instance a student in my class shared my teacher's slide presentation link and I noticed that the file name was includ...

lgosp-poc

LG On Screen Phone authentication bypass PoC What is LG On Screen Phone? The LG On-Screen Phone application OSP makes it easy to access and control LG’s Android smartphones through a PC. The connection can be established either by using an USB cable or wirelessly through Wi-Fi or Bluetooth. When...

METATRON

METATRON AI-powered penetration testing assistant using local LLM on linux Parrot OS 🔱 METATRON AI-Powered Penetration Testing Assistant 📌 What is Metatron? Metatron is a CLI-based AI penetration testing assistant that runs entirely on your local machine — no cloud, no API keys, no subscriptions...

ovswrap-poc

ovswrap-poc CVE-2026-64531 OVSwrap PoC - Linux kernel Open vSwitch LPE; for patch validation and security research...

CVE-2021-3156

CVE-2021-3156 Note: These instructions are my own and notes from a stream that I did. If anything is wrong, then let me know. Trust official sources first! Hello everyone, A couple of days back, a serious heap-based buffer overflow has been discovered in sudo that is exploitable by any local user...

CVE-2026-43499-Poc-Analysis

CVE-2026-43499 Android arm64 Local Privilege Escalation Adaptation English | 中文 This is an Android arm64 local privilege escalation adaptation project for CVE-2026-43499. The project generates a target-specific target.h from the target device's boot.img and profile, then builds the corresponding...

CVE-2023-28252-Compiled-exe

CVE-2023-28252-Compiled-exe A modification of Fortra's excellent CVE-2023-2852 Privesc Exploit. Works on Windows 11 21H2 clfs.sys version 10.0.22000.1574 - also works on Windows 10 21H2, Windows 10 22H2, Windows 11 22H2 and Windows server 2022. This version retains the original functionality, but...

CVE-2026-96455

The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachymini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsgetappmanager, which just hands back the manager object from applicatio...

exploit_linux_kernel4.13

This repo contains an old poc that combines three CVEs CVE-2017-14954, CVE-2017-18344, CVE-2017-5123. The poc is a Local Privilege Escalation for Linux Kernel 4.13 tested on Ubuntu. The exploit uses an info leak CVE-2017-14954 to bypass KASLR, an arbitrary read CVE-2017-18344 to read the kernel...

cve-2026-23111-poc

CVE-2026-23111 For more details, see notes.md Description CVE Description from NIST An inverted logical check in nftmapcatchallactivate causes nftchain-use reference count to not be restored when a DELSET operation is aborted. This allows triggering UAF, and can be abused to obtain local privileg...

RogueWinRM

RogueWinRM RogueWinRM is a local privilege escalation exploit that allows to escalate from a Service account with SeImpersonatePrivilege to Local System account if WinRM service is not running default on Win10 but NOT on Windows Server 2019. Briefly, it will listen for incoming connection on port...

CVE-2021-1732

CVE-2021-1732 CVE-2021-1732 Microsoft Windows 10 Local Privilege Escalation Vulnerability Research and PoC/Exploit Development Affected Systems and Application Versions Windows Server, version 20H2 Server Core Installation Windows 10 Version 20H2 for ARM64‑based Systems Windows 10 Version 20H2 fo...

Metabase_CVE-2021-41277

MetabaseCVE-2021-41277 Description Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs...

CVE-2021-4034

CVE-2021-4034 PolKit Local Privilege Escalation Analysis toc Vulnerability Overview Vulnerability ID: CVE-2021-4034 Vulnerability Score: Affected Product: linux PolKit pkexec Affected Versions: Versions from 2009 to present current 0.105 Reference http://its.dlut.edu.cn/info/1054/78309.htm Exploi...

DirtySlide

DirtySlide Unprivileged → root macOS LPE. An 8-byte OOB read/write into kernel memory adjacent to a dyld shared-cache page, from a missing in-page bounds check in the v5 slide walk vmsharedregionslidepagev5, reachable via syscall 536. Patched in macOS 26.5.2 25F84, xnu-12377.121.10. Vulnerable...

CVE-2020-13884

Exploit Title: Citrix Workspace app before 1912 for Windows - Privilege Escalation 2 Date: 2020-06-07 Author: Andrew Hess Software Link: https://www.citrix.com/downloads/workspace-app/legacy-workspace-app-for-windows/workspace-app-for-windows-1911.html/ Bulletin:...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 Proof of concept — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 Single-file proof-of-concept for CVE-2026-43494 PinTheft: a Linux kernel local privilege escalation that chains an RDS zerocopy reference-count bug with iouring...

OA-tongda-RCE

OA-tongda-RCE | Office Anywhere Web-based Intelligent Office System Backend Getshell No Authentication Required 1. Arbitrary file upload vulnerability /ispirit/im/upload.php 2. Local file inclusion vulnerability /ispirit/interface/gateway.php Command Execution Bypass: root@kitploit: exec"cmd /c...

LFI-aiohttp-CVE-2024-23334-PoC

LFI-aiohttp-CVE-2024-23334-PoC A Bash script to automate Local File Inclusion LFI attacks on vulnerable aiohttp servers, specifically targeting CVE-2024-23334. This exploit allows for unauthorized access to arbitrary files on systems running affected versions of aiohttp with improperly configured...

explain-my-curl

explain-my-curl explain-my-curl is a local-first CLI for understanding what a curl command is doing across DNS, TLS, and HTTP. This repository currently includes: A CLI command to parse and explain a curl input A starter TUI for interactive exploration Execution telemetry for DNS, TCP connect, TL...