287313 matches found
EUVD-2026-76061
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied CryptoWallet values are base64-encoded but not HTML-escaped before storage in walletlog.information. Administrators viewing pending...
CVE-2024-22120-RCE-with-gopher
Uso root@kitploit: python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime Escenario de ejemplo Has identificado un servidor Zabbix ejecutรกndose en la IP 192.168.1.100, y tienes acceso a un usuario con pocos privilegios con los siguientes detalles: ID de sesiรณn sid:...
CVE-2026-82329-poc
CVE-2026-82329 Artifactory Security Assessment Tool PoC dan alat validasi untuk mengidentifikasi instalasi JFrog Artifactory self-hosted yang terdampak CVE-2026-82329. Alat ini memvalidasi rantai autentikasi berikut: 1. Membuat join JWT HS256 menggunakan signing key default yang kosong. 2. Mengir...
NextJS-RCE-Root-Takeover
๐จ Do you know how to get RCE with Next.js 16.0.6 then privilege escalation with python3? ๐จ Let me teach you from a real lab from TryHackMe "Love at First Breach 2026" competition Advanced Track... ๐ Full Report Here: ๐ฅ Inside: CVE-2025-55182 โ Shell PoC โ Privilege Escalation โ Root + Remediation...
CVE-2026-77159 Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...
CVE-2026-77159
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...
EUVD-2026-76034
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...
CVE-2026-47839
A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...
Fsociety-CVE-2024-0670-CheckMK-LPE
๐ Fsociety-CVE-2024-0670-CheckMK-LPE - ๅผบๅคง็็ณป็ป่ฎฟ้ฎ๏ผๅฆๆญค็ฎๅ ๐ฆ ๆฆ่ฟฐ ไฝ ๅฅฝ๏ผๆๅใ่ฏฅๅทฅๅ ทไธบ CheckMK CVE-2024-0670 ่งฃ้้ซ็บง่ฎฟ้ฎๆ้ใๅฎๅฉ็จ่ๅผฑ็ๆไปถๅค็ๆบๅถๆฅ่ทๅ SYSTEM ๆ้ใ่ฏฅ่ฝฏไปถๅ ๅซไธ้กนไธ้จ็ๆไน ๅๅ่ฝใๅฎไฝฟ็จ C++ ๅผๅ๏ผๆจๅจไธบ็จๆทๆไพๅจ Windows ็ฏๅขไธญ่ฟ่กๆๆๆ้ๆๅๆ้็ๅทฅๅ ทใ ๐ ๏ธ ๅ่ฝ็นๆง ้ซ็บง LPE ๏ผ้่ฟๅทฒ่ฏๅซ็ๆผๆด่ทๅ SYSTEM ่ฎฟ้ฎๆ้ใ ๆไน ๅๆจกๅ ๏ผๅณไฝฟ็ณป็ป้ๅฏๅไป่ฝ็ปดๆ่ฎฟ้ฎใ ็จๆทๅๅฅฝ็้ข ๏ผไธไธบๆ็จๆง่่ฎพ่ฎก๏ผๅณไฝฟๆฏ้ๆๆฏ็จๆทไน่ฝ่ฝปๆพไธๆใ ๅ ผๅฎนๆง ๏ผ้็จไบ Windows...
CVE-2026-47839
Cloud Foundry UAA and cf-deployment are vulnerable to a privilege-escalation flaw in federated OIDC authentication. When an OIDC identity provider is configured with groupMappingMode: AS_SCOPES and a wildcard externalGroupsWhitelist entry, users can obtain the uaa.admin scope despite operators in...
CVE-2026-47839 Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin
A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...
EUVD-2026-76026
A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...
CVE-2020-24030
CVE-2020-24030 Descripciรณn ForLogic Qualiex v1 y v3 tiene una expiraciรณn de token dรฉbil. Esto permite la escalada de privilegios remota no autenticada y el acceso a datos sensibles mediante la reutilizaciรณn de tokens. Fechas importantes Anuncio al proveedor: 2020-07-12 Fecha de divulgaciรณn pรบblic...
LeakedWallpaper
Leaked Wallpaper This is a privilege escalation tool fixed with CVE-2024-38100 in KB5040434 that allows us to leak a user's NetNTLM hash from any session on the computer, even if we are working from a low-privileged user. Usage root@kitploit: .\LeakedWallpaper.exe \\c$\1.jpg -downgrade Example...
Disable-TamperProtection
Disabling Tamper Protection and other Defender / MDE components It is possible to abuse SYSTEM / TrustedInstaller privileges to tamper or delete WdFilter settings ALTITUDE regkey and unload the kernel minidriver to disable Tamper protection and other Defender components. This also affects...
germy
Overview germy is an NGSM Linux kernel privilege escalation exploit for versions 5.15-rc1 to 6.6-rc1. See TECHNICALDETAILS.md for information on the vulnerabilities and exploit techniques used. Tested on: Ubuntu LTS 20.04.6 5.15.x and 22.04.4 6.5.x Ubuntu non-LTS 23.10 6.5.x Debian 12.5 6.1.x Usa...
WHS4_CVE-2021-4034
CVE-2021-4034 PwnKit - Local Privilege Escalation PoC ๐ Original Project : berdav/CVE-2021-4034 This project is an educational analysis and modification based on the original. MIT License Compliant | White Hat School Training Task ๐ Overview CVE-2021-4034 is a local privilege escalation...
CoercedPotatoRDLL
Coerced Potato Reflective DLL Privilege escalation from NT Service to SYSTEM using SeImpersonateToken privilege and MS-RPRN functions. Heavily based on https://github.com/Prepouce/CoercedPotato Reflective Loader from https://github.com/stephenfewer/ReflectiveDLLInjection. Install Clone this repo...
cve-2025-62215-exploit-poc
CVE-2025-62215 ๆฆๅฟต้ช่ฏ โ ๏ธ ่ญฆๅ - ๆณๅพไธ้ๅพทๅฃฐๆ ๆญคไปฃ็ ไป ไพๆ่ฒๅๅฎๅ จ็ ็ฉถไน็จใ ่ฏทๅฟ ๅจๆชๆฅๆๆๆช่ทๆ็กฎไนฆ้ข่ฎธๅฏ็็ณป็ปไธไฝฟ็จๆญคไปฃ็ ่ฏทๅฟ ๅฐๆญคไปฃ็ ็จไบๆถๆ็ฎ็ ๅจๅคงๅคๆฐๅธๆณ็ฎก่พๅบ๏ผๆช็ปๆๆ่ฎฟ้ฎ่ฎก็ฎๆบ็ณป็ปๅฑ่ฟๆณ่กไธบ ไฝ่ ไธ่ดก็ฎ่ ไธๅฏนไปปไฝๆปฅ็จๆญคไปฃ็ ็่กไธบ่ด่ดฃ ไฝฟ็จ้ฃ้ฉ่ช่ด - ๆญคไปฃ็ ๅฏ่ฝๅฏผ่ด็ณป็ปไธ็จณๅฎๆๅดฉๆบ ๆผๆดๆฆ่ฟฐ CVE-2025-62215 ๆฏไธไธช Windows ๅ ๆ ธๆ้ๆๅๆผๆด๏ผ ็ฑปๅ : ๆ้ๆๅ๏ผEoP๏ผ CVSS ่ฏๅ : 7.0๏ผ้ซๅฑ๏ผ ๆ นๆฌๅๅ : ๅ ๆ ธ่ตๆบๅๆญฅไธญ็็ซๆๆกไปถ๏ผCWE-362๏ผ ๅ้้ๆพๅ ๅญ็ ดๅ๏ผCWE-415๏ผ ๅฝฑๅ :...
prefetch-tool
Windows KASLR Prefetch Tool A proof-of-concept tool for bypassing KASLR kernel ASLR on Windows 11. Inspired by EntryBleed for Linux. This tool was developed as part of an exploit targetting Windows 11 24H2. I am not a side-channel expert at all, so this was very much new territory for me and the...