CVE-2026-76727

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...

CVE-2026-76724

A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a...

CVE-2026-76728

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery SSRF attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the...

CVE-2026-76721

Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the...

CVE-2026-76728

A vulnerability exists in the API endpoint of HPE Networking Instant ON APs , where an authenticated remote attacker with high privileges can perform a server-side request forgery (SSRF) attack. Successful exploitation may enable the attacker to execute arbitrary commands as a privileged user on ...

EUVD-2026-89346

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...

CVE-2026-76724

A command injection vulnerability exists in the Command Line Interface (CLI) of HPE Networking Instant ON APs when accessed via the PAPI protocol . An unauthenticated adjacent attacker can exploit this by sending specially crafted packets to perform command injection. Successful exploitation allo...

EUVD-2026-89340

Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the...

CVE-2026-76721

A buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON APs . This flaw allows an unauthenticated remote attacker to execute arbitrary code on the underlying host. If successfully exploited, the attacker could gain the ability to run code as a privileged user...

CVE-2026-100287

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request...

CVE-2024-3183-POC

CVE-2024-3183-POC POC para CVE-2024-3183 FreeIPA Rosting Impacto: Un usuario con pocos privilegios puede obtener un hash de las contraseñas de todos los usuarios del dominio y realizar fuerza bruta offline kerberoasting. Parche para impacket-getTGT: 1. Añade decoder.decode.defaultErrorState =...

CVE-2021-31762

CSRF-to-RCE ..| CVE-2021-31762 |.. 描述： 利用跨站请求伪造（CSRF）攻击，通过Webmin的添加用户功能创建特权用户，然后通过Webmin的运行进程功能获取反弹Shell 测试版本： Webmin 1.973（GitHub最新版本 2021/03/07） 攻击类型： 远程 影响： 远程命令执行 漏洞利用POC代码： YouTube POC： https://youtu.be/qCvEXwyaF5U 产品供应商： https://www.webmin.com 附加信息：...

CheeseTools

CheeseTools 本仓库基于已有的 MiscTool 构建，在此特别感谢 rasta-mouse 发布这些工具，并给予我改进它们的动力。 CheeseExec 通过类似 PsExec 的功能实现命令执行/横向移动。必须在拥有特权的用户上下文中运行。 该工具基于 rasta-mouse 的 CsExec，但设计上提供了对服务创建的额外控制，具体包括： 创建（检查服务是否存在，若不存在则尝试创建） 启动（检查服务是否存在且已停止，若是则尝试启动；否则尝试创建并启动） 停止（检查服务是否存在且正在运行，若是则尝试停止） 删除（检查服务是否存在且正在运行，若是则尝试停止后删除，否则直接删除...

CVE-2024-22120-RCE-with-gopher

使用方法 python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime 示例场景 你发现了一个运行在 IP 192.168.1.100 上的 Zabbix 服务器，并且拥有一个低权限用户，其详细信息如下： 会话ID（sid）：d82bf6715e1d3c1f25 主机ID（hostid）：10107 PHP 会话ID（phpsessid）：a4g7f48d9j3r7h8s9g 你希望利用此脚本利用 RCE 漏洞。 运行脚本 python exploit.py --ip 192.168.1.100 --si...

CVE-2026-98007

A flaw was found in the Linux kernel. A privileged local user can cause a Denial of Service DoS by loading a specially crafted BPF Berkeley Packet Filter program that passes a pointer value instead of a scalar number as the loop iteration count to the bpfloop function. Because the kernel's BPF...

CVE-2026-34213

CVE-2026-34213 一个低权限的 Docmost 用户可以向通用上传端点提供一个受害者的 attachmentId，并覆盖同一工作空间内另一页面的存储附件。 引言 我在 Docmost （开源协作文档平台）中发现、负责任地披露并复现了一个 高严重性 的授权缺陷。 Docmost 官网将其描述为可本地部署、适合企业的 wiki，拥有 300万+ 次下载，并表示受到包括 维尔纽斯市 、Bechtle 、澳大利亚政府 、红十字会 和 ETS Quebec 在内的团队信任。 该漏洞存在于 Docmost 也用于图表保存/更新流程的通用文件上传路径中。...

CVE-2026-93272

A flaw was found in the Linux kernel's Qualcomm Wireless Connectivity Subsystem WCNSS remoteproc driver. When initializing hardware configurations that lack power domain regulators, an incorrect pointer calculation shifts past the bounds of the regulator array. A local privileged user could trigg...

W&B Weave Server - Remote Arbitrary File Leak

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin. id:...

CVE-2026-101064

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and clo...

CVE-2021-32160

..| XSS to Privileged user |.. Description : Exploiting a Reflected Cross-Site Scripting XSS attack to create a privileged user through the Webmin's add users feature then getting a reverse shell through the Webmin's running process feature Tested Version : Webmin 1.973 GitHub's latest version...