CVE-2024-1642470

Windows USB Generic Parent Driver Remote Code Execution Vulnerability CVE-2024-1642470 Overview This repository contains a proof-of-concept PoC exploit code and a detection script for the Windows USB Generic Parent Driver Remote Code Execution Vulnerability, identified as CVE-2024-1642470...

CVE-2026-42945

CVE-2026-42945 - NGINX Rift Vulnerability Analysis and Reproduction Overview CVE-2026-42945 codename "NGINX Rift" is a heap buffer overflow vulnerability in the NGINX ngxhttprewritemodule, with a CVSS v4 score of 9.2 Critical. Discovered by the depthfirst security research team in April 2026, thi...

CVE-2024-24919

Check Point Security Gateway RCE Exploit Tool CVE-2024-24919 Overview This repository contains a tool for exploiting the CVE-2024-24919 vulnerability in Check Point Security Gateways. The tool is a multi-scanner that can identify vulnerable devices and a single-target exploit that can take full...

RTSPServer-Code-Execution-Vulnerability

Live Networks LIVE555 streaming media RTSPServer lookForHeader code execution vulnerability CVE-2018-4013 Summary An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library. A specially crafted packet can cause a stack-based buff...

CVE-2026-53921-PoC-Exploit

CVE-2026-53921 – odhcpd Stack Overflow For educational and authorized testing only. Unauthorized use is illegal. Vulnerability Overview CVE-2026-53921 is a critical stack buffer overflow in OpenWrt’s odhcpd daemon – the default DHCPv6/DHCPv4/RA server. How it works The vulnerability exists in...

katana

Katana A BootROM exploit for Qualcomm devices released within 2016 til 2019. Brief Explanation of the Exploit With the MSM8998 Nazgul SoC, the command 0x13 SAHARARESETSTATEMACHINEID was added. The command called into bootsaharaentry, which is supposed to reinitialize Sahara. The flaw is that each...

cve-2019-6250-lab

CVE-2019-6250 — libzmq pre-auth RCE lab End-to-end working RCE chain + reproducible lab for CVE-2019-6250 , the pre-auth heap-buffer-overflow in libzmq's v2decodert::sizeready. A uint64t pointer-arithmetic overflow lets an unauthenticated peer overwrite the adjacent msgt::contentt::ffn function...

Windows-kernel-SegmentHeap-Aligned-Chunk-Confusion

This repository contains a PoC exploit using an exploitation technique called Aligned Chunk Confusion. The details on the technique can be found in the paper. This exploit leverages a heap overflow in the Windows kernel heap to elevate its privileges from Low to SYSTEM. The research The goal of t...

CVE-2025-46817

CVE-2025-46817 – Redis Lua unpack Integer Overflow Potential RCE Redis Lua unpack integer overflow PoC causing stack blow-up and crash on 8.2.1. Overview Redis 8.2.1 ships Lua 5.1 with an unpack implementation that computes the result count using signed integers. Carefully chosen start/end indice...

CVE-2026-2005

CVE-2026-2005 - PostgreSQL pgcrypto Heap Overflow Exploit PoC exploit for a heap-based buffer overflow in the PostgreSQL pgcrypto extension's PGP session key parsing, leading to arbitrary memory read/write and privilege escalation to superuser. For full technical details, see the Zeroday Cloud...

cve-2023-5217-poc

CVE-2023-5217: libvpx VP8 Encoding Heap Overflow PoC CVE-2023-5217 is an in-the-wild exploited libvpx vulnerability that was found by Clément Lecigne of Google's Threat Analysis Group to be targeting Chrome. This repo shows how to trigger CVE-2023-5217 in the browser using the WebCodecs and...

LooneyPwner

LooneyPwner Exploit tool for CVE-2023-4911, targeting the 'Looney Tunables' glibc vulnerability in various Linux distributions. LooneyPwner is a proof-of-concept PoC exploit tool targeting the critical buffer overflow vulnerability, nicknamed "Looney Tunables," found in the GNU C Library glibc...

CVE-2021-1965

CVE-2021-1965 CVE-2021-1965 WiFi Zero Click RCE Trigger PoC This is a quick&dirty Proof-of-Concept code to verify if your phone is vulnerable. After running the poc code, your phone is supposed to crash&reboot within seconds. In case you need more info about the bug & vulnerable code, here you ar...

CVE-2006-3747

Files about my bugtraq publication and first working exploit for CVE-2006-3747 Apache modrewrite LDAP off-by-one buffer overflow. http://www.securityfocus.com/archive/1/443870 Public release date of POC/Exploit: 2006-08-20 Author: Jacobo Avariento Gimeno CVE id: CVE-2006-3747 Bugtraq id: 19204 CE...

CVE-2013-2028-Exploit

CVE-2013-2028 Exploit Vulnerability details Vulnerable software: Nginx 1.3.9 -lp 4. Let the exploit find actual value of the canary, and start reverse-shell...

AppleDOS

AppleDOS CVE-2018-4407 Based on CVE-2018-4407 https://lgtm.com/blog/applexnuicmperrorCVE-2018-4407, this tweet, and this video. The bug is heap overflow vulnerability in bad packet handling when OS try to send ICMP message containing segments from bad packet back to the sender. This POC will...

PoC

Leveraging CVE-2018-19788 to dump protected files without root shell CVE-2018-19788 is an issue where any user with a UID over INTMAX IE 4000000000 can run any systemctl command on a systemd linux box, such as Ubuntu. There is already a writeup to gain a root shell found: here. The main differenc...

CVE-2021-3156

CVE-2021-3156: Heap-Based Buffer Overflow in Sudo Baron Samedit Root Exploit No BruteForce All research credit: Qualys Research Team Check out the details on their blog. Manually installed Ubuntu 20.04 LTS and Sudo version 1.8.31 on Docker container for testing purpose and running the command...

CVE-2020-14871-Exploit

CVE 2020-14871 Solaris exploit This is a basic ROP based exploit for CVE 2020-14871. CVE 2020-14871 is a vulnerability in Sun Solaris systems. The actual vulnerability is a classic stack-based buffer overflow located in the PAM parseusername function. It can be reached by manipulating SSH client...

CVE-2019-19012

Integer overflow in Oniguruma An integer overflow in the searchinrange function in regexec.c in Oniguruma 6.x before 6.9.4rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. This only affects the 32-bit compiled version. Remote attackers can...