CVE-2026-41091-PoC-Exploit

CVE-2026-41091 - RedSun SolarFlare - Microsoft Defender LPE Exploit Legal Disclaimer & Responsible Use This tool is provided for educational and authorized penetration testing purposes only. The authors and contributors are not responsible for any misuse or damage caused by this software. Users a...

CVE-2024-27518

CVE-2024-27518 - SUPERAntiSpyware Professional X LPE PoC This vulnerability was discovered and disclosed by M. Akil Gündoğan from Secunnix Vulnerability Research Team. This repository will hold the proof-of concept and advisories. Details: Product: SUPERAntiSpyware Professional X and all editions...

CVE-2024-44193

Hacking Windows through iTunes - Local Privilege Escalation 0-day Introducing CVE-2024–44193 This is a write up on CVE-2024–44193 which is a Local Privilege Escalation exploit in iTunes version 12.13.2.3. It was patched September 12, 2024 by Apple. Link to Apple's Security Advisory: Apple's...

CVE-2026-81572

CodeMeter Runtime (WibuSystems) on Windows is vulnerable to a local privilege escalation via a predictable temporary file. The cmu.exe executable, when invoked with --create-io --file C:, creates a temporary file under C:\CM-Stick without checking the directory and file paths for NTFS reparse poi...

CVE-2026-81572 Local Privilege Escalation in CodeMeter Runtime on Windows

In CodeMeter Runtime from version 8.40 to excluding 8.41a and 9.00 to excluding 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before fi...

PT-2026-82475

Name of the Vulnerable Software and Affected Versions CodeMeter Runtime affected versions not specified Description The cmu.exe utility creates a predictable temporary file in the C:CM-Stick directory when the --create-io flag is used with the --file parameter. The application fails to properly...

CVE-2026-41091-PoC-Exploit Full-PoCv2

☀️ CVE-2026-41091 - RedSun SolarFlare - Microsoft Defender LPE Exploit Microsoft Defender Link Following Vulnerability - Local Privilege Escalation to NT AUTHORITY\SYSTEM The vulnerability is known as "RedSun" 🎯, "SolarFlare" is the name I gave to my exploit. ✅ 📌 Overview This repository contains...

EUVD-2020-7120

Malware in sbrugna...

EUVD-2014-0599

Malware in sbrugna...

EUVD-2021-22906

Malware in sbrugna...

EUVD-2014-8975

Malware in sbrugna...

EUVD-2023-31852

Malicious code in bioql PyPI...

CVE-2020-14990

IOBit Advanced SystemCare Free 13.5.0.263 allows local users to gain privileges for file deletion by manipulating the Clean & Optimize feature with an NTFS junction and an Object Manager symbolic link...

CVE-2020-15401

IOBit Malware Fighter Pro 8.0.2.547 allows local users to gain privileges for file deletion by manipulating malicious flagged file locations with an NTFS junction and an Object Manager symbolic link...

Microsoft Windows NTFS Junction Heap-based Buffer Overflow Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of NT...

CVE-2023-50915

An issue exists in GalaxyClientService.exe in GOG Galaxy Beta 2.0.67.2 through 2.0.71.2 that could allow authenticated users to overwrite and corrupt critical system files via a combination of an NTFS Junction and an RPC Object Manager symbolic link and could result in a denial of service...

CVE-2023-50915: Authentication Bypass Using an Alternate Path or Channel

An issue exists in GalaxyClientService.exe in GOG Galaxy Beta 2.0.67.2 through 2.0.71.2 that could allow authenticated users to overwrite and corrupt critical system files via a combination of an NTFS Junction and an RPC Object Manager symbolic link and could result in a denial of service...

CVE-2023-50915

An issue exists in GalaxyClientService.exe in GOG Galaxy Beta 2.0.67.2 through 2.0.71.2 that could allow authenticated users to overwrite and corrupt critical system files via a combination of an NTFS Junction and an RPC Object Manager symbolic link and could result in a denial of service...

CVE-2023-50915

The GOG Galaxy (Beta) game client (versions 2.0.67.2 through 2.0.71.2 ) contains a vulnerability in GalaxyClientService.exe . This issue stems from improper file handling where the privileged service writes logs as NT AUTHORITY/SYSTEM into a directory where standard users possess read, write, and...

PT-2024-14007 · Gog · Gog Galaxy

Name of the Vulnerable Software and Affected Versions: GOG Galaxy Beta versions 2.0.67.2 through 2.0.71.2 Description: An issue exists in GalaxyClientService.exe that could allow authenticated users to overwrite and corrupt critical system files via a combination of an NTFS Junction and an RPC...