CVE-2023-29343

CVE-2023-29343 이것은 Sysmon 버전 14.14의 임의 파일 쓰기 버그에 대한 PoC입니다. 마지막 패치 이후 Sysmon은 Archive 디렉터리가 존재하는지 확인하고, 존재할 경우 해당 디렉터리가 NT AUTHORITY\SYSTEM 소유이고 NT AUTHORITY\SYSTEM에게만 액세스 권한이 부여되었는지 확인합니다. 두 조건이 모두 참이면 Sysmon은 해당 디렉터리에 파일을 쓰거나 삭제합니다. 낮은 권한의 사용자로 파일/디렉터리의 소유권을 변경할 수 없기 때문에, SYSTEM이 소유하지만 낮은 권한의...

EUVD-2026-65543

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

Nostromo_Python3

Nostrom RCE Python3 익스플로잇 코드: 사용법: root@kitploit: $ python3 ./exp.py vulnerable.host 8080 id uid=65534 gid=65534...

privilege-escalation-breach

Projet de brèche de sécurité - Élévation de privilèges La vulnérabilité se trouve dans Oracle Solaris, un produit d'Oracle Systems composant : XScreenSaver. La version prise en charge concernée est la 11. Il s'agit d'une vulnérabilité facilement exploitable qui permet à des attaquants faiblement...

CVE-2023-33253

CVE-2023-33253 LabCollector с 6.0 по 6.15 позволяет удалённое выполнение кода Аутентифицированный удалённый пользователь с низкими привилегиями может загрузить исполняемый PHP-файл и выполнить системные команды. Уязвимость находится в функции message и вызвана недостаточной проверкой отправляемог...

Rocket-Chat-3.12.1-PoC-CVE-2021-22911-

Rocket-Chat-3.12.1-PoC-CVE-2021-22911- 1. Перейдите на страницу входа 2. Зарегистрируйте новый аккаунт, установите пароль P@$$w0rd!1234 3. Запустите скрипт -u = email пользователя с низкими привилегиями без 2FA -a = email администратора -t = URL Например: http://rocketchat.local python3...

CVE-2025-65271

CVE-2025-65271 PoC pour CVE-2025-65271 Comment exécuter ? node server.js Description L'injection de templates côté client CSTI dans le tableau de bord administrateur du CMS Azuriom permet à un utilisateur à faibles privilèges d'exécuter du code template arbitraire dans le contexte de la session...

CVE-2023-32707

CVE-2023-32707 Un POC amélioré basé sur le CVE signalé sur exploitdb Exploit Title: Splunk 9.0.5 - Prise de contrôle du compte administrateur CVE: CVE-2023-32707 Vue d'ensemble Ce script permet d'exploiter une vulnérabilité dans Splunk 9.0.5, conduisant à une prise de contrôle du compte...

Johnson Controls Metasys 12.x / 13.x / 14.x < 14.1.5 / 15.x < 15.0.1 Cross-Site Scripting (CVE-2026-34491)

A low-privilege user can inject a malicious XSS payload into the Johnson Controls Metasys UI via a crafted URL. The payload persists across logins and executes in the browser context of other users, including administrators. Successful exploitation of this vulnerability could allow a low-privileg...

UBUNTU-CVE-2026-73196

A flaw was found in FreeIPA. A low-privilege authenticated user can ex...

CVE-2026-55491 BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script...

PT-2026-79192

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.29 Description An issue exists where the software fails to escape the meetingName variable in the record-and-playback/screenshare/playback/index.html.erb file during the generation of the screenshare playbac...

PT-2026-78907

Name of the Vulnerable Software and Affected Versions Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 affected versions not specified Description An issue exists where improper enforcement of role-based access control allows a low privileged remote attacker with a valid session to create new...

CVE-2026-76394

Splunk AI Toolkit versions below 6.0.0 have multiple REST API handlers that fail to enforce authorization checks, allowing low-privileged users (without admin or power roles) to start/stop/configure containers and read/modify connection and configuration data. CVSS 8.3 HIGH; remediation is to upg...

CVE-2026-76360 Information Disclosure through Missing Authorization in the Health REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not...

CVE-2024-56071

🚨 Simple Dashboard = 2.0 - Escalade de Privilèges Non Authentifiée 📄 Description Le plugin Simple Dashboard pour WordPress est vulnérable à l'Escalade de Privilèges dans toutes les versions jusqu'à la 2.0 incluse. Cela permet à des attaquants non authentifiés d'élever leurs privilèges à ceux d'un...

PT-2026-78736

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A low-privileged user without admin or power roles can...

SAP NetWeaver AS ABAP Missing Authorization Check (3752864)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a missing authorization check vulnerability as referenced in SAP Security Note 3752864: - SAP NetWeaver and ABAP Platform Change and Transport System - Customer Transport Integration Wizard allows a low-privileged use...

CVE-2026-72686

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation...

CVE-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification

Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating...