CVE-2026-0047-poc

CVE-2026-0047：ActivityManagerService 中缺失的权限检查 从每个正在运行的应用中窃取成堆的位图 — 零权限、零用户交互。 ActivityManagerService.dumpBitmapsProto 中缺少 enforceCallingOrSelfPermissionDUMP 检查，导致 Android 16 QPR2 Beta Baklava 上任何已安装的应用都能从所有正在运行的进程中窃取 UI 位图。 注意： 此漏洞并非由我们发现。发现并负责任地报告该漏洞的所有功劳归于原始研究人员。本仓库包含我们独立的补丁分析、复现过程和教育性分析文章...

velociraptor_CVE-2025-6264_PoC

CVE-2025-6264 免责声明： 这是一个教育研究项目。我并非此漏洞的发现者。本仓库演示 CVE-2025-6264，仅供学习目的。 受影响版本：0.74.3 之前 影响 Windows、MacOS 和 Linux Admin.Client.UpdateClientConfig 工件缺少权限检查。具有 Investigator 角色（拥有 COLLECTCLIENT 权限）的用户可以使用它来更新客户端配置，尽管他们本不应被允许这样做。这使你可以将客户端重定向到你自己的恶意 Velociraptor 服务器，并接管端点。...

CVE-2025-4631

🚨 CVE-2025-4631 - Exploit de Escalada de Privilegios del Plugin Profitori de WordPress 📌 Resumen de la Vulnerabilidad El Plugin Profitori versiones 2.0.6.0 a 2.1.1.3 es vulnerable a una escalada de privilegios no autenticada debido a la falta de una comprobación de capacidades en el endpoint...

CVE-2023-33477

CVE-2023-33477 Harmonic NSG 9000-6G モジュレータは、config.exp 設定ファイルにおいて不正なダウンロードの脆弱性を抱えています 本モデルのモジュレータにおける "cgi.bin/config.exp" ファイルへのアクセス許可検証が欠如しているため、リモート接続中の任意のユーザーが設定ファイルのダウンロードを要求できます。設定ファイルには多数の機密インターフェースとリクエストメソッドが記載されており、攻撃者はこれを利用してデバイスのさらなるテストを行うことが可能です...

EUVD-2026-80079

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

CVE-2022-35841

CVE-2022-35841 Este es solo un pequeño informe con la teoría, ya que este fallo fue colisionado y nunca llegué a probarlo adecuadamente. EnterpriseAppMgmtSvc es un servicio interesante que implementa objetos COM. Parece datar de Windows Phone y, de hecho, la mayoría de las interfaces COM...

CVE-2026-18426

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

EUVD-2026-79942

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

CVE-2026-58726

In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-57012

In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56970

In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56982

In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0179

In Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58726

In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-79010

In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-78992

In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-57012

CVE-2026-57012 affects the Setup Wizard component of Android (Pixel), where a missing permission check permits a remote package install , enabling remote privilege escalation without user interaction or additional execution privileges. The CVSS 3.1 score is 7.8 (HIGH) with a local attack vector, ...

CVE-2026-57012

In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-78983

In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56982

In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...