CVE-2024-22120-RCE-with-gopher

Usage python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime Example Scenario You have identified a Zabbix server running on IP 192.168.1.100, and you have access to a low-privileged user with the following details: Session ID sid: d82bf6715e1d3c1f25 Host ID hostid: 10107 PHP...

privilege-escalation-breach

Security breach project - Privilege escalation The vulnerability is in Oracle Solaris, a product of Oracle Systems component: XScreenSaver. The supported version that is affected is 11. It's an easily exploitable vulnerability which allows low privileged attackers with logon to the infrastructure...

CVE-2025-20029

CVE-2025-20029: Command Injection in TMSH CLI in F5 BIG-IP A command injection vulnerability exists in the F5 “tmsh” restricted CLI which allows an authenticated attacker to leverage the commands accessible by a low privilege user in order to bypass restrictions, inject arbitrary commands and...

LeakedWallpaper

Leaked Wallpaper This is a privilege escalation tool fixed with CVE-2024-38100 in KB5040434 that allows us to leak a user's NetNTLM hash from any session on the computer, even if we are working from a low-privileged user. Usage .\LeakedWallpaper.exe \\c$\1.jpg -downgrade Example...

EDR-ALPC-Block-POC

EDR ALPC-Block POC Blocking Windows EDR agents by registering an own IPC object in the Object Manager’s namespace CVE-2023-3280, CVE-2024-5909, CVE-2024-20671 and others without assigned CVEs Introduction This repository contains example code demonstrating how to exploit DoS vulnerabilities prese...

CVE-2025-65271

CVE-2025-65271 PoC for CVE-2025-65271 How to run? node server.js Description Client-side template injection CSTI in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard...

CVE-2024-22120-RCE

CVE-2024-22120 ToolKit Affected Version/s 6.0.0 - 6.0.27 6.4.0 - 6.4.12 7.0.0alpha1 Credit https://x.com/mf0cuz https://support.zabbix.com/browse/ZBX-24505 https://packetstormsecurity.com/files/137454/Zabbix-3.0.3-Remote-Command-Execution.html Premise a low-privilege user Have permission to execu...

CVE-2022-26923_AD-Certificate-Services

CVE-2022-26923 AD Certificate Services Date of publication : 10/05/2022 Attack complexity: Low Privileges required: Low CVSS Score : 8.1 The vulnerability allowed a low-privileged user to escalate privileges to domain administrator in a default Active Directory environment with the Active Directo...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

CVE-2023-29343

CVE-2023-29343 This is PoC for arbitrary file write bug in Sysmon version 14.14 After last patch Sysmon would check if Archive directory exists and if it exists it would check if archive directory is owned by NT AUTHORITY\SYSTEM and access is only granted to NT AUTHORITY\SYSTEM. If both condition...

NetRipper

Description NetRipper is a post exploitation tool targeting Windows systems which uses API hooking in order to intercept network traffic and encryption related functions from a low privileged user, being able to capture both plain-text traffic and encrypted traffic before encryption/after...

portabilis-ieducar-user-type-privilege-escalation

Portabilis i-Educar = 2.1.13 Privilege Escalation Through Arbitrary Request to User Type Change Endpoint Proof of concept for exploitation of the vulnerability described in CVE-2025-11554, which concerns the possibility of a privilege escalation during arbitrary requests to user types endpoints i...

CVE-2024-3553

CVE-2024-3553 Tutor LMS = 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hidenotices function in all...

MAL-002

MAL-002: Force System Restart via Installed Windows MSIs Once a software is successfully installed on the system, one or more trusted MSI files will appear in the “C:\Windows\Installer” folder and may allow a low privilege user to perform “repair” and/or “modify” actions as the “NT...

CVE-2026-44595

CVE-2026-44595 — YAMCS Unauthorized User Enumeration via IAM API Summary The IAM API endpoints listUsers, getUser, listGroups, getGroup in yamcs-core do not enforce the required SystemPrivilege.ControlAccess check. Any authenticated user — even one with no privileges — can enumerate all user...

CVE-2026-61797

CVE-2026-61797 — GLPI PDF Plugin Time-Based Blind SQL Injection Proof of Concept for CVE-2026-61797 , a time-based blind SQL Injection vulnerability affecting the GLPI PDF plugin. The vulnerability can be reached through: /marketplace/pdf/front/preference.form.php In the vulnerable implementation...

CVE-2026-113660

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized...

EUVD-2026-105208

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized...

CVE-2026-34308

CVE-2026-34308: MySQL Server JSON component denial of service Official vendor bulletin: Oracle Critical Patch Update Advisory — April 2026. Summary from published CVE Vulnerability in Oracle MySQL Server component: Server: JSON. Supported affected versions: 8.0.0–8.0.45 , 8.4.0–8.4.8 , and...

CVE-2026-20805-POC

CVE-2026-20805 PoC Proof of concept for the information disclosure vulnerability in Microsoft's Desktop Window Manager dwm.exe. 📋 Vulnerability Summary ID: CVE-2026-20805 Product: Microsoft Windows Component: Desktop Window Manager dwm.exe CWE-ID: CWE-200 Exposure of Sensitive Information to an...