27880 matches found
copy-fail-cve-2026-31431
Copy Fail - CVE-2026-31431 本仓库提供了公开 Copy Fail PoC 的 Go 移植版本，以及一个可复现的多架构 Linux 二进制构建流水线。 Copy Fail（CVE-2026-31431）是 Linux 内核中 authencesn 的一个逻辑缺陷，它能够通过 AFALG + splice 实现对页缓存数据确定性的 4 字节写入。 负责任使用 请仅在您被明确授权测试的环境中使用本项目。请勿针对您不拥有或未经书面许可评估的系统运行此 PoC。 快速测试（无需构建） 如果您想立即测试而无需从源码构建，请下载发布二进制文件并运行：...
CVE-2026-86753
snipe-it (asset management application by grokability) versions before 8.7.0 contain a business logic bypass in the POST /account/request/asset_model/{modelId} endpoint. The root cause is a failure to validate the requestable flag for asset models, allowing authenticated users to bypass administr...
CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint
snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...
CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint
snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...
CVE-2026-86740
Snipe-IT before 8.7.0 contains a flaw in UploadedFilesController::destroy() and Api\UploadedFilesController::destroy() where the return value of Storage::delete() is not checked. As a result, attachment deletion requests report success and files are hidden from listings, yet the physical files pe...
LSPromise
LSPromise A complete exploit chain that enables privilege escalation from a local untrusted app to root/kernel. It does not involve memory corruptions or race conditions, so attackers don't need to perform complex heap spraying or bypass mitigations against memory corruption vulnerabilities such ...
TLPE
This is a PoC and a writeup for CVE-2026-49881, a logic issue in the InCallController class in Android 17's Telecom service that allows an unprivileged app to gain arbitrary code execution as UID 1000 systemserver with no extra user interaction. We also show here that systemserver code execution...
tirreno
tirreno tirreno is open security analytics. tirreno tir.ˈrɛ.no helps understand, monitor, and protect your applications from cyber threats, account takeovers, bots, and abuse. While classic cybersecurity focuses on infrastructure and network perimeter, most breaches occur through compromised...
CVE-2026-16960
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...
EUVD-2026-74717
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...
CVE-2026-16960
The Loops & Logic WordPress plugin (versions before 4.3.0 ) exposes an unrestricted public template-data action , allowing unauthenticated users to read arbitrary user records—including email addresses and roles —as well as arbitrary site options. The root cause is a missing permission check on t...
EUVD-2026-74701
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...
CVE-2026-16960 Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...
copyfail-go
CopyFail Go 大多数 Linux LPE 漏洞需要竞态窗口或特定内核的偏移量。Copy Fail 是一个直线型逻辑缺陷——两者都不需要。同一个 732 字节的 Python 脚本 静态 Go 二进制即可攻破自 2017 年以来发布的所有 Linux 发行版。 CVE-2026-31431 的 Go 实现。适用于你需要静态二进制且不依赖 Python 的情况。 更多信息请参阅 copy.fail。 交互式 Shell root@kitploit: Get the binary to your Linux host with code execution exercise for...
copyfail-go
CopyFail Go Most Linux LPEs need a race window or a kernel-specific offset. Copy Fail is a straight-line logic flaw — it needs neither. The same 732-byte Python script static Go binary roots every Linux distribution shipped since 2017. A Go implementation of CVE-2026-31431. In case you need a...
Exploit for CVE-2026-49881
This is a PoC and a writeup for CVE-2026-49881, a logic issue in...
CVE-2024-53677
POC from https://y4tacker.github.io/2024/12/16/year/2024/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E9%80%BB%E8%BE%91%E7%BB%95%E8%BF%87-CVE-2024-53677-S2-067/ RCE Conditions No restriction on dangerous file extensions File name obtained from upload parameters when uploading files...
CVE-2023-32413
macOS LPE CVE-2023-32413 / ZDI-23-845 / Pwn2Own Vancouver 2023 exploit This is the exploit code that has been played at Pwn2Own Vancouver 2023 https://youtu.be/c0cS4R0ja-I?t=180. This code exploits CVE-2023-32413 to gain root rights on any vulnerable macOS. The vulnerability is a logic TOCTOU tha...
Kibana 9.4.x < 9.4.5 / 9.5.x < 9.5.1 Information Disclosure (ESA-2026-168)
The version of Kibana installed on the remote host is 9.4.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-168 advisory. - Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to informatio...