juicy-potato

Juicy Potato（滥用黄金权限） RottenPotatoNG的加糖版本，带点汁水，即另一个本地权限提升工具，从Windows服务账户到NT AUTHORITY\SYSTEM 概述 RottenPotatoNG及其变种利用基于BITS 服务的权限提升链，该服务在127.0.0.1:6666上具有MiTM监听器，并且当你拥有SeImpersonate或SeAssignPrimaryToken权限时。在一次Windows构建审查中，我们发现一个设置，其中BITS被故意禁用，端口6666被占用。 我们决定将RottenPotatoNG武器化：向Juicy Potato打个招呼 。...

CVE-2026-88904

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...

CVE-2026-85128

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved...

CVE-2024-37726-MSI-Center-Local-Privilege-Escalation

CVE-2024-37726 Escalada de Privilegios Local en MSI Center – Vulnerabilidad de Sobrescritura Arbitraria de Archivos Resumen de la Vulnerabilidad Se ha identificado una vulnerabilidad de escalada de privilegios local en sistemas Windows en versiones de MSI Center = 2.0.36.0, que permite a un usuar...

exploits-rconfig

exploits Tres exploits para rconfig = 3.9.4 : root@kitploit: CVE-2019-19509 : authenticated RCE CVE-2019-19585 : Local Privilege Escalation root CVE-2020-10220 : unauthenticated SQLi rconfigrootRCEunauth.py : chaining the three CVEs above to get root reverse shell without authentication...

CVE-2022-41040-metasploit-ProxyNotShell

CVE-2022-41040-metasploit-ProxyNotShell el script de metasploit POC sobre CVE-2022-41040. Microsoft Exchange es vulnerable a un ataque de falsificación de solicitudes del lado del servidor SSRF. Un atacante autenticado puede usar la vulnerabilidad para escalar privilegios. preparación del POC...

CVE-2021-3560

CVE-2021-3560 CTF 一个针对ubunutu中polkit权限提升漏洞的简单poc脚本...

CVE-2026-46300

安全研究与法律免责声明 本仓库仅用于教育和授权的安全研究目的。 允许的使用 在受控环境（本地虚拟机、隔离实验室）中理解安全漏洞及其利用概念 研究沙箱隔离机制及其局限性 学习安全的软件设计与防御性安全实践 获得系统所有者明确书面授权的渗透测试 禁止的使用 攻击、利用或未经授权访问任何系统、网络或数据 开发或分发恶意软件、勒索软件或恶意工具 任何非法或不道德的安全活动 法律声明 您有责任遵守所有适用法律 未经明确授权，不得在生产系统或公共互联网上使用本内容 作者不对因使用本内容而导致的任何滥用或损害承担责任 使用本仓库即表示您同意：...

CVE-2026-92043

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Audio/Video component...

microcode_ctl security, bug fix, and enhancement update

An update is available for microcodectl. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The microcodectl packages provide microcode updates for Intel and AMD...

Ubuntu-GameOver-Lay

UbuntuP-GameOverLay Usando CVE-2023-2640 CVE-2023-3262 para escalar privilegios CVE 2023-2640 https://nvd.nist.gov/vuln/detail/CVE-2023-2640 En los kernels de Ubuntu que contienen tanto c914c0e27eb0 como "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs. xattrs", un usuari...

freeswitch_rce

version: 由于 freeswitch 通常以高权限运行，因此也可以实现权限提升的效果...

EUVD-2026-81348

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...

CVE-2026-88904

The PuppyFW WordPress plugin through 0.4.4 has a broken authorization flaw in one of its REST routes: the plugin validates the caller against a capability value taken from the request itself rather than a server-side trusted source. This allows any authenticated user , including low-privilege sub...

CVE-2026-88904 PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...

CVE-2026-85128 Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Request

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved...

EUVD-2026-81336

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved...

CVE-2026-85128

The Choose User Role at Registration WordPress plugin (for WooCommerce) before 1.3.3 fails to validate the role requested at registration against the roles an administrator chose to offer. This allows unauthenticated users to request any role—including administrator —and be granted it once the re...

CVE-2022-0847-dirty-pipe-exploit

CVE-2022-0847-dirty-pipe-exploit 针对CVE-2022-0847脏管道漏洞的一个利用 使用方法 通过 gcc exploit.c -o exploit 编译（假设已安装gcc） 运行 ./exploit 即可获得root shell 如果出现类似这样的错误信息，则： 以 root 身份登录，密码为 cspshivam 然后，通过运行 mv /tmp/passwd.bak /etc/passwd 恢复 /etc/passwd...

CVE-2022-0847-DirtyPipe-Exploits

CVE-2022-0847-DirtyPipe-Exploits Una colección de exploits y documentación para testers de penetración y red teamers que puede ser utilizada para ayudar en la explotación de la vulnerabilidad Dirty Pipe de Linux. Acerca de la Vulnerabilidad Dirty Pipe CVE-2022-0847 es una vulnerabilidad de escala...