EUVD-2026-60438

ApostropheCMS: Missing destination-parent authorization in page move allows a low-privileged editor to move and re-rank pages inside a restricted subtree...

json-interop-vuln-labs

JSON 互操作性漏洞实验室 描述 这些是我研究文章《探索 JSON 互操作性漏洞》的配套实验室。 实验 1：电子商务应用中的免费购买 键碰撞攻击：重复键优先级不一致 大数表示不一致 实验 2：多租户应用中的权限提升 键碰撞攻击：字符截断 默认情况下，这些实验室绑定到主机的 5000-5004 端口。 攻击技术 1. 键碰撞 重复键优先级不一致 root@kitploit: "qty": 1, "qty": -1 字符截断 对于后键优先的解析器，会发生截断（对于前键优先的解析器，则需翻转顺序） root@kitploit: "qty": 1, "qty": -1 "qty": 1,...

CVE-2023-20938-poc

CVE-2023-20938 — Android binder UAF privilege escalation A local privilege escalation proof-of-concept for CVE-2023-20938 , a use-after-free in the Android binder driver. From an unprivileged shell it gains uid 0 and drops SELinux to permissive , then spawns a root shell. Target for this build:...

CVE-2026-7867-disk2root

Filesystem.Mount → as-user Spoofing → Authorization Bypass → Root-context Mount → LPE Overview CVE-2026-7867 is a local privilege escalation vulnerability in udisks2 involving the Filesystem.Mount D-Bus method, the as-user option, fstab-managed mount flows...

CVE-2026-31431

Description: Cfail is my implementation in C++ x86-64 Assembly of CVE-2026-31431 aka Copyfail, with no dependecy required at all, included libc. In fact, you obtain am universal executable able to run stand-alone on every Linux x86-64 distribution, thanks to a minimal implementation of the standa...

KSuRoot

KSuRoot 基于 CVE-2026-43499（GhostLock） 内核漏洞的一键 KernelSU 提权工具。 本分支以 KSURoot 为蓝本，完整同步 Root-My-Galaxy v0.2.6 主线更新，并新增自定义导入动态库 功能。 Mod by hmascs · 版本 2.2.0（versionCode 220）· Apache-2.0 功能亮点 一键提权 ：基于 CVE-2026-43499 内核漏洞完成提权并安装 KernelSU，无需解锁 Bootloader 主线同步 ：对齐 Root-My-Galaxy v0.2.6 —— Jetpack Compose...

CVE-2023-33730

CVE-2023-33730 — eScan 管理控制台权限提升 严重性： 严重 CVE ID： CVE-2023-33730 披露日期： 2023 年 5 月 30 日 作者： Sahil Ojha 目录 概述 漏洞详情 影响 技术分析 概念验证 修复建议 参考资料 免责声明 概述 eScan 管理控制台 是 Microworld Technologies 开发的一款集中式安全管理解决方案。它允许企业 IT 管理员通过单一 Web 控制台，在整张网络中部署、管理并监控 eScan 防病毒/端点保护代理。 该控制台的 14.0.1400.2281 版本存在一个严重的 权限提升 漏洞。由于...

DEMO-Proof-of-Concept-Temporal-Memory-Inconsistency-in-cldflt.sys-CVE-2025-62221

Technical Analysis and Proof-of-Concept: Temporal Memory Inconsistency in cldflt.sys CVE-2025-62221 DEMO Proof-of-Concept: Temporal Memory Inconsistency in cldflt.sys CVE-2025-62221 CVE-2025-62221: This repository provides a comprehensive technical analysis and a Proof-of-Concept PoC demonstratio...

EUVD-2026-57317

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision...

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Summary Semaphore resolves a project member's effective permissions in ProjectMiddleware by looking up a role row whose slug matches the member's assigned role, and overwrites the built-in permission bitmask with that row's value. A member holding the built-in manager role creates a custom projec...

CVE-2026-85390

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...

EUVD-2026-70672

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting...

CVE-2026-85395 UnoPim before 2.1.3 Missing Authorization on Integration Management Routes

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting...

CVE-2026-85395 UnoPim before 2.1.3 Missing Authorization on Integration Management Routes

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting...

CVE-2026-85395

UnoPim before 2.1.3 is affected by a missing authorization vulnerability in the Bouncer middleware . The integration store, update, and key-generation routes were omitted from the ACL map, allowing any user with minimal admin privileges to bypass permission checks. An attacker can create OAuth AP...

CVE-2026-85390

Checkmate through 3.11.0 omits the isAllowed role guard middleware on its maintenance-window, notification, and check-deletion routes, allowing users with a read-only role to perform administrative actions. A low-privileged attacker with a valid user-role session can create arbitrary maintenance ...

CVE-2026-85390 Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...

oni-framework

Oni-Framework Oni 框架是一个用于嵌入式设备软件开发的平台。它用于远程调试/为嵌入式设备添加功能。目前，其核心概念是一个完全模块化的插件系统，支持本地和远程 RPC。该框架设计为在 ring-0 特权级别运行，但经过一些调整也可以在 ring-3 级别使用。请注意，这 不 适合生产环境使用，仅供希望获得简便研究构建平台的开发人员使用。 目前该项目仍在开发中，可能尚未完全测试 需要具备较好的 C/C 知识 魔法 新功能！ 当前支持的功能 完全健壮的本地和远程 RPC 系统 所有使用到的函数均已打桩（stub），以便于移植到不同平台 文件传输工具 彩色日志系统（可通过 UAR...

CVE-2020-29669

Macally WIFISD2-2A82 Informe sobre CVE-2020-29669 por Maximilian Barz Silky y Daniel Schwendner code-byter ========================== Este es un informe sobre la explotación del router de viaje Macally WIFISD2-2A82 versión de firmware: 2.000.010. El usuario Guest puede restablecer su propia...

WPTimeCapsulePOC

Backup y Staging de WP Time Capsule 1.21.16 - Prueba de Concepto de Bypass de Autenticación Recientemente se descubrió un bypass de autenticación https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/ en WP Time Capsule 1.21.16 . Este PoC demuestra cómo funciona el proble...