12 matches found
cve-2026-9082-drupal-postgresql-rce
CVE-2026-9082 Drupal PostgreSQL SQL 注入到 RCE 该仓库包含一个本地实验环境和一个简短的漏洞利用脚本，用于 Ambionics 文章中描述的 Drupal JSON:API PostgreSQL SQL 注入漏洞。 该漏洞利用的关键在于 PostgreSQL 权限提升：一旦注入能够以 PostgreSQL 超级用户身份执行 SELECT 表达式，它就会通过大对象（large objects）写入一个原生预加载库，重新加载 postgresql.auto.conf，触发 sessionpreloadlibraries，并通过 pgreadfile...
Exploit for Use After Free in Linux Linux_Kernel
CVE-2026-43499-pgp110 CVE-2026-43499 futex PI rtmutex...
Exploit for Use After Free in Linux Linux_Kernel
Aristotle ADB Enable A minimal Android app that turns on AD...
EUVD-2026-39965
The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the PSUGID process flag. During execve2, this flag is not yet set at the point where the auxiliary vector is constructed, so ATSECURE was incorrectly set to zero for set-user-ID and set-group-ID executables. A...
CVE-2026-49413 Flaw in Linuxulator execution of setugid binaries
The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the PSUGID process flag. During execve2, this flag is not yet set at the point where the auxiliary vector is constructed, so ATSECURE was incorrectly set to zero for set-user-ID and set-group-ID executables. A...
CVE-2026-49413
The Linuxulator component in the FreeBSD kernel is vulnerable to a flaw where it incorrectly sets the AT_SECURE flag to zero for set-user-ID or set-group-ID Linux binaries. This occurs because the P_SUGID process flag is not yet set during execve(2) when the auxiliary vector is constructed. An un...
FreeBSD -- Flaw in Linuxulator execution of setugid binaries
Problem Description: The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the PSUGID process flag. During execve2, this flag is not yet set at the point where the auxiliary vector is constructed, so ATSECURE was incorrectly set to zero for set-user-ID and...
EUVD-2026-22178
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protection mechanism allows an authenticated user with tool execution privileges to escape the LDPRELOAD-based sandbox. By env command the attacker can clear the environment variables and drop...
Exploit for CVE-2015-1328
CVE-2015-1328 Proof of Concept A Proof of Concept PoC explo...
CVE-2025-34190 Vasion Print (formerly PrinterLogic) PrinterInstallerClientService Authentication Bypass via LD_PRELOAD Hooking
Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 macOS/Linux client deployments are vulnerable to an authentication bypass in PrinterInstallerClientService. The service requires root privileges for certain...
CVE-2023-1521
On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LDPRELOAD. If the server is run as root which is the default when installing the snap package https://snapcraft.io/sccache , this means a user...
