gtfobins-cli

🚀 GTFOBins CLI Descripción general GTFOBins CLI es una interfaz de línea de comandos para GTFOBins, que proporciona acceso instantáneo a técnicas de explotación de binarios Unix. Esta herramienta ayuda a profesionales de seguridad y administradores de sistemas a identificar y comprender cómo se...

CVE-2022-0492

CVE-2022-0492 容器逃逸分析 toc 漏洞简介 漏洞编号: CVE-2022-0492 漏洞产品: linux kernel - cgroup 影响版本: linux kernel 5.17-rc3 漏洞危害: 当容器没有开启额外安全措施时，获得容器内root 权限即可逃逸到宿主机 环境搭建 在存在漏洞版本的内核的linux中使用docker 即可。 关闭所有安全防护启动docker docker run --rm -it -h cve --name cve --security-opt="seccomp=unconfined"...

CVE-2025-29927

CVE-2025-29927 Next.Js 权限绕过漏洞CVE-2025-29927 更多poc见 https://pc.fenchuan8.com//index?forum=101158&yqm=DGR4X path默认/，多线程默认10 批量检测： python poc.py -f url.txt -p /path -t 10 单个检测： python poc.py -u your-ip -p /path -t 10...

TeamViewer_Permissions_Hook_V1

TeamViewer Hook de Permisos V1 Una DLL de C++ inyectable como prueba de concepto, que utiliza hooking inline directo y modificación directa de memoria para cambiar los permisos de TeamViewer. Características Como servidor – Habilita opciones adicionales en el menú emergente del lado derecho. La m...

CVE-2023-2640-CVE-2023-32629

GameOverlay Ubuntu 权限提升 CVE-2023-2640 https://www.cvedetails.com/cve/CVE-2023-2640/ 在同时携带 c914c0e27eb0 和 "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs. xattrs" 的 Ubuntu 内核上，非特权用户可能在挂载的文件系统上设置特权扩展属性，导致这些属性在没有适当安全检查的情况下被设置到上层文件。 CVE-2023-32629...

CVE-2026-28576-poc

CVE-2026-28576: SQL Injection in the Android Contacts Provider One picked contact, every contact: a targetSdk compat gate turns a single-contact picker grant into a full contacts database dump. Android 17 hardened the Contacts Provider against SQL injection with setStrictColumns / setStrictGramma...

CVE-2025-10184_PoC

APK Build for CVE‑2025‑10184 PoC 这是一个 CVE‑2025‑10184 的 PoC 的 APK 构建 该漏洞存在于 com..providers.telephony 中, 允许任意应用在未获得 SMS 读取权限的情况下读取短信 源码 此源码及更多细节可见 Rapid7 的文章： https://www.rapid7.com/blog/post/cve-2025-10184-oneplus-oxygenos-telephony-provider-permission-bypass-not-fixed/ 下载 请登录后在 Actions 下载 未签名 的安装...

Nginx-CVE-2013-4547

Nginx 文件名逻辑漏洞（CVE-2013-4547） 漏洞说明 影响版本：Nginx 0.8.41 1.4.3 / 1.5.0 1.5.7 参考链接： https://vulners.com/cve/CVE-2013-4547 https://blog.werner.wiki/file-resolution-vulnerability-nginx/ http://www.91ri.org/9064.html 漏洞说明 这个漏洞其实和代码执行没有太大关系，其主要原因是错误地解析了请求的URI，错误地获取到用户请求的文件名，导致出现权限绕过、代码执行的连带影响。...

CVE-2024-23700

CVE-2024-23700 - PoC de escalada de privilegios en Android Companion Device Proyecto que ilustra CVE-2024-23700, una vulnerabilidad de escalada de privilegios relacionada con el mecanismo Companion Device en Android. El PoC demuestra que una aplicación puede aprovechar el flujo de vinculación de...

CVE-2025-55130

CVE-2025-55130 - Escape del Modelo de Permisos de Node.js mediante Enlaces Simbólicos / | | | | |/ \ / \ | | | | / | // \ | | || | || || || | | | | \ | \ \ | | | | | | |/|| \ ||| ||/||| | || | || | |/ |//||// Node.js Permission Model Bypass via Crafted Symlinks Discovered by natann @ JFrog...

CVE-2026-100617

Cap-go capgo.app fails to validate that principals in channelpermissionoverrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant...

EUVD-2026-87459

OpenClaw is an agent gateway distributed via npm. In versions = 2026.4.10 and 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable...

CVE-2023-42442

CVE-2023-42442 CVE-2023-42442 Vulnerabilidad de descarga arbitraria de grabaciones de sesión de JumpServer Descripción de la vulnerabilidad CVE-2023-42442 es una vulnerabilidad combinada que incluye dos errores en Jumpserver 1. Acceso no autorizado a la API que filtra información de sesión 2...

AOSP-DownloadProviderHijacker

AOSP-DownloadProviderHijacker PoC que explota la omisión de permisos en el Proveedor de Descargas de Android CVE-2018-9468 Aviso de Seguridad https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-Permission-Bypass-CVE-2018-9468.pdf Más Información...

CVE-2026-53628

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator'...

CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

CVE-2026-67407

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex...

CVE-2026-67241

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name lines 192-240 checks only configure on the declared exchange and passes XArgs straight to rabbitexchange:declare/7. ...

DEBIAN-CVE-2026-67407

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex...

DEBIAN-CVE-2026-61837

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET...