CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

token-priv

Abusing Token Privileges For EoP August 2017 Bryan Alexander @dronesec Stephen Breen @breenmachine This repository contains all code and a Phrack-style paper on research into abusing token privileges for escalation of privilege. Please feel free to ping us with questions, ideas, insults, or bugs...

Kerberos-CVE-2026-27912

Kerberos-CVE-2026-27912 CVE-2026-27912 - Windows Kerberos Elevation of Privilege Vulnerability ResetNightmare - Unauthorized password reset via Kerberos Change Password protocol flaw. 📋 Details Field| Value ---|--- CVE| CVE-2026-27912 Title| Windows Kerberos Elevation of Privilege Vulnerability...

CVE-2026-18486

IBM ContextForge MCP Gateway = v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters...

CVE-2026-17499

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

BadSamba

描述 此模块用于利用 Windows 组策略设置中的启动脚本执行， 这些脚本被配置为从远程 SMB 共享运行。 Windows 组策略可用于配置启动脚本，这些脚本将在操作系统每次开机时 执行，并以高权限账户 NT AUTHORITY/SYSTEM 运行。 如果攻击者能够执行流量操纵攻击，并在系统重启期间将流量重定向 到恶意 SMB 服务器，就有可能以 SYSTEM 账户 远程执行命令。 此模块接受所有形式的身份验证，无论是匿名、 域账户、空密码还是不存在的账户。它允许任何用户连接 到 SMB 服务器和共享。 它还会执行文件伪装，无论客户端原始请求的是哪个文件， 也无论客户端连接到哪个 S...

CVE-2015-1701

CVE-2015-1701 Vulnerabilidad de Elevación de Privilegios en Win32k. Información original https://www.fireeye.com/blog/threat-research/2015/04/probableapt28useo.html Protección Aplicar MS15-051 para la corrección. https://technet.microsoft.com/library/security/MS15-051 CVE Entrada del Diccionario:...

acunetix_0day

Acunetix 0day RCE - SYSTEM Acunetix 0day RCE Usage Run script with root@kitploit: dzonerzy:dvm dzonerzy$ python /Users/dzonerzy/PycharmProjects/natbypass/acu0day.py 9999 172.16.24.1 Acunetix WVS 10 - SYSTEM Remote Command Execution Daniele Linguaglossa Payload: Meterpreter reverse TCP 4444 Exploi...

Win10Pcap-Exploit

Win10Pcap-Exploit credit to https://twitter.com/R00tkitSMM [email protected] telegram username : https://telegram.me/firozi some day ago i found vulnerability in win10pcap Driver that can lead to Privilege escalation i report vulnerability and now bug is fixed : www.win10pcap.org/download/ s...

uacscript

UAC Bypass Vulnerability in Windows Script Host The Windows Script Host executables suffer from a vulnerability due to a missing embedded manifest. Using another exploit, the combination of "wusa.exe" and "makecab.exe" files can be copied to the Windows folder. Copies of a manifest and the script...

CVE-2024-48590

CVE-2024-48590 Vulnerability Disclosure: SSRF in Inflectra SpiraTeam 7.2.00 Description Inflectra SpiraTeam version 7.2.00 is vulnerable to Server-Side Request Forgery SSRF through the NewsReaderService component. Vulnerability Type Server-Side Request Forgery SSRF Vendor Inflectra Affected Produ...

slui-file-handler-hijack-privilege-escalation

Slui File Handler Hijack LPE Exploit Information| ---|--- Date| 15.01.2018 Patched| Windows 10 20H1 19041 exploit-db| 44830 Tested on| Windows 8-10, x86/x64 independent Description slui.exe is an auto-elevated binary that is vulnerable to file handler hijacking. Read access to...

DIR8xx_PoC

phpcgi phpcgi is responsible for processing requests to .php, .asp and .txt pages. Also, it checks whether a user is authorized or not. Nevertheless, if a request is crafted in a proper way, an attacker can easily bypass authorization and execute a script that returns a login and password to a...

CVE-2024-30088

CVE-2024-30088 Este repositorio contiene un Proof of Concept PoC escrito en Python para la vulnerabilidad CVE-2024-30088. Este código es un intento de replicar la vulnerabilidad como ejercicio técnico, con fines puramente educativos y demostrativos, de cómo Python de alguna manera "flaquea" tambi...

CVE-2026-18486

IBM ContextForge MCP Gateway (≤ v1.0.7) is vulnerable to credential disclosure and privilege escalation via improper validation of jq filters . An authenticated user with developer privileges can supply a malicious jq program in the jsonpath_filter field that executes unrestricted built-in functi...

EUVD-2026-71605

IBM ContextForge MCP Gateway = v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters...

CVE-2026-75171

An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component...

CVE-2026-75160

An issue in X-Serie Gateway Firmware V60005 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi...

VulnHub-DC1-Writeup

VulnHub-DC1-Writeup "渗透测试实验室报告，记录了从侦察到 root 的完整攻击链。" 🔓 VulnHub — DC-1 Boot-to-Root 靶机 Writeup 难度： 初级–中级 平台： VulnHub 目标： 获取全部 4 个 flag 并实现完整的 root 级攻陷 攻击机系统： Kali Linux（VirtualBox — NAT 网络） 目标机系统： Debian Linux（Drupal 7 CMS） 📌 目录 1. 实验环境搭建 2. 侦察与信息收集 3. 漏洞利用 — 远程代码执行 4. 后渗透 — Shell 稳定化 5. Flag 1 —...

GhostLock

GhostLock - CVE-2026-43499 Local Privilege Escalation Exploit Vulnerability Overview CVE ID: CVE-2026-43499 Vulnerability Type: futex PI priority inheritance stack UAF Use-After-Free Affected Range: Linux kernel 6.1 6.12 Android GKI Exploitation Impact: Local privilege escalation + SELinux disabl...