Meta Box <= 4.16.2 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajaxdeletefile function. The function accepts any attachmentid from the POST request and directly calls wpdeleteattachment or unlink without validating that the attachment belongs to the specified Meta Box field,...

PasswordPusher v1.45.11-v2.9.5 - Unauthenticated Anonymous Push Deletion via Ownership Bypass

PasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous pushes due to a nil==nil ownership-check bypass CWE-863. The deletion guard evaluates @push.user == currentuser || @push.deletablebyviewer. For anonymous pushes, @push.user is nil; for unauthenticated requests,...

CVE-2026-96525 MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...

CVE-2026-0023-Update-Ownership-PoC

CVE-2026-0023 - Android Update Ownership 신뢰 우회 PoC CVE-2026-0023을 재현하고 연구하기 위한 완전한 Android 실험실 환경입니다. 이 저장소는 CVE-2026-0023이 일반 설치자가 시스템만 제어해야 하는 내부 Android 설치 플래그에 영향을 미칠 수 있게 하여, 앱 업데이트 중 Android의 업데이트 소유권 경고가 억제되는 방식을 보여줍니다. 이 프로젝트는 현실적인 업데이트 소유권 워크플로를 모델링하고 취약한 동작을 관찰할 수 있는 재현 가능한 환경을 제공하는 세 가...

acltoolkit

acltoolkit acltoolkit은 ACL 남용을 위한 스위스 군용 칼입니다. 여러 가지 ACL 남용을 구현합니다. 목차 acltoolkit 목차 설치 사용법 명령어 get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript 설치 root@kitploit: pip install acltoolkit-ad 또는 root@kitploit: git clone https://github.com/zblurx/acltoolkit.gi...

OwnershipStealer

OwnershipStealer このCコードは、指定されたファイルの所有権を取得しようとするコンソールアプリケーションです。 コードのロジック プログラムはまず、コマンドライン引数としてファイル名が指定されているかどうかを確認し、指定されていない場合はユーザーに入力を促します。その後、次の手順でファイルの所有権を取得しようとします。 現在のプロセストークンを取得します。 SeTakeOwnershipPrivilegeのLUID（Locally Unique Identifier）を検索します。 トークン内のSeTakeOwnershipPrivilegeを有効にします。...

CVE-2026-95835 Missing ownership check on the shared memory object named by the kitty askpass escape code

Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handleremoteaskpass in kitty/window.py opens the POSIX shared memory...

CVE-2026-97561 smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid

In the Linux kernel, the following vulnerability has been resolved: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid When the administrator mounts with forceuid or forcegid uid=/gid= mount options, they expect all files to appear owned by the specified user/group. However, severa...

CVE-2026-97561

The Linux kernel contains a vulnerability where the SMB client fails to honor forceuid and forcegid mount options. Specifically, the functions smb311_posix_info_to_fattr(), cifs_posix_to_fattr(), and parse_sec_desc() unconditionally called sid_to_id(), allowing server-provided values to overwrite...

EUVD-2026-86869

In the Linux kernel, the following vulnerability has been resolved: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid When the administrator mounts with forceuid or forcegid uid=/gid= mount options, they expect all files to appear owned by the specified user/group. However, severa...

asnap

Asnap 설명 Asnap은 정기적으로 업데이트된 데이터를 제공하여 어떤 회사가 어떤 IPv4 또는 IPv6 주소를 소유하고 있는지 쉽게 파악하고, 사용자가 초기 포트 및 서비스 스캔을 자동화할 수 있도록 하여 정찰 단계를 더 쉽게 만드는 것을 목표로 합니다. root@kitploit: █████╗ ███████╗███╗ ██╗ █████╗ ██████╗ ██╔══██╗██╔════╝████╗ ██║██╔══██╗██╔══██╗ ███████║███████╗██╔██╗ ██║███████║██████╔╝...

CVE-2026-79759 Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values...

CVE-2026-79759

The web-based server management platform Termix (versions 1.7.0 through 2.5.1) is vulnerable to cross-user information disclosure due to a missing ownership check in the POST /credentials/:id/deploy-to-host endpoint. Located in src/backend/database/routes/credentials.ts, the application fails to ...

SearchIPOwner

SearchIPOwner - h3x0v3rl0rd - 使用例: 単一IPクエリ: root@kitploit: python3 SearchIPOwner.py 8.8.8.8 ファイルから複数のIP: root@kitploit: python3 SearchIPOwner.py iplist.txt CSVに保存: root@kitploit: python3 SearchIPOwner.py iplist.txt -csv...

pwnfb50

pwnfb50 任意のFB50スマートロックの所有権を自分自身に移譲します CVE-2019-13143 PoCビデオ 使用方法 root@kitploit: $ python3 pwnfb50.py id mac ここで、id はあなたのユーザーID、mac はロックのMACアドレスです。...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation のメモリAPIにおける所有権チェックの欠如により、ユーザー間をまたいだメモリの読み取りと削除が可能でした。 主なアドバイザリ: GHSA-qv97-83w4-ff86 研究者クレジット: @chaitanyagarware 早見表 フィールド| 値 ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project| vmDeshpande/ai-agent-automation Package| backend Ecosystem| npm 深刻度| 高 CVS...

CVE-2026-16264

The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record...

CVE-2026-84743

The Events Calendar WordPress plugin (versions 6.15.16.1 through 6.17.4 ) is vulnerable to an incorrect authorization flaw. The plugin fails to perform per-object capability checks on a specific family of REST write routes (specifically those using by-slug ). This allows users with low-privilege ...

EUVD-2026-85040

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including...

CVE-2026-84743 The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including...