CVE-2026-92761 WebVirtCloud Missing Authorization on Instance Control Actions

WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the getinstance gate...

geiger

geiger A Geiger counter for AI agents. One read-only command that inventories every AI agent, harness, MCP server, plugin, and AI extension on a machine — and tells you, in plain language, what each one can touch. root@kitploit: npx geiger-scan No install. No account. No telemetry. Reads configs...

WordPress Tutor LMS plugin < 4.0.8 - Read-Only API Key Privilege Escalation vulnerability

Read-Only API Key Privilege Escalation vulnerability discovered by Charles Vosburgh in WordPress Plugin Tutor LMS versions 4.0.8...

CVE-2016-5195

This record is for learning purposes only; any illegal use is prohibited. Principle The vulnerability works by concurrently flushing dirty pages, causing the content of a file that was originally read-only to be modified. If the modified file is owned by root and has the SUID permission, it can b...

glpi-logbleed

glpi-logbleed GLPI 历史日志过滤器中的 SQL 盲注。CVE-2026-53629，已在 11.0.8 和 10.0.26 中修复，自 9.4.0 起存在漏洞。 需要任意具备 logs 读取权限的账户。默认自带的只读（Read-Only）配置文件就有该权限。 安全公告：GHSA-cpcj-x335-5cmh 技术分析：我是怎么发现的 漏洞 Log::convertFiltersValuesToSqlCriteria 将 affectedfields 过滤器拆分为 key:operator:values。针对 CVE-2026-29047 的补丁校验了 operator...

dirtyCow

Dirtycow 也被称为 CVE-2016-5195，是过去非常流行的一个漏洞。 首先，选择适合该漏洞的 Linux 版本。 然后在 VBOX 或 VMWare 上安装或运行它。 安装后，按照以下说明操作： 1. 创建一个没有 root 访问权限的用户。 2. 登录到该用户。 3. 创建目录。 4. 为 '.txt' 文档创建 root 访问权限，并仅赋予只读权限。 5. 在创建 '.txt' 文件的目录中编译并运行 '.c' 文件。 6. 然后运行它，运行前需要提供两个参数。 ./compilenameoffilecreated r-only file writeheresometh...

CVE-2026-85569

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it...

CVE-2022-0847

CVE-2022-0847 Linux 内核自 5.8 版本起存在的一个漏洞，允许覆盖任意只读文件中的数据。这会导致权限提升，因为非特权进程可以向 root 进程注入代码。 编译：gcc poc.c -o poc 用法：./poc TARGETFILE OFFSET DATA 作者及更多信息：https://dirtypipe.cm4all.com/...

openclaw-hardening-check

本脚本仅执行读取操作。它不修复任何问题，也不保证您的安全。绿色输出仅表示下列检查已通过——仅此而已。 OpenClaw 加固检查 openclaw-hardening-check.mjs 是一个小型、无依赖、离线的 OpenClaw 安装审查工具。它会读取本地配置、包元数据、插件和技能清单、文件模式，以及在 Linux 上通过 /proc 读取正在运行的 Gateway 的条目。它不修改文件、不调用 OpenClaw 命令、不连接注册中心，也不发起任何网络请求。 检查内容 Gateway 绑定: 报告 gateway.bind 是仅回环地址、非回环地址还是运行时依赖。在检测到...

linux-privilege-escalation

Linux 权限提升 Bash 脚本，用于检查并利用 Linux 漏洞 CVE-2022-0847（“Dirty Pipe”） 关于此 PoC 此脚本允许易受攻击系统上的非特权用户执行以下操作： 修改/覆盖 只读 文件，如 /etc/passwd。 获取一个提权后的 shell 本仓库包含 2 个利用脚本： 利用脚本 1： 将 root 密码替换为 “piped”，并将原始 /etc/passwd 文件备份到 /tmp/passwd.bak。然后，该利用脚本提供一个提权后的 root shell，并在退出 shell 时恢复原始 passwd 文件。 利用脚本 2： 向以 root...

CVE-2026-9090-Modbus-TCP-Write-to-Read-Only-Coils-via-Function-Code-Spoofing

CVE-2026-9090 – Escritura Modbus TCP a Bobinas de Solo Lectura mediante Suplantación de Código de Función Código del Programa Python con simulación pymodbus root@kitploit: modbusplcsim.py - Simulated Modbus PLC with read‑only coils from pymodbus.server.sync import StartTcpServer from...

Exploit-Dirty-Cow

漏洞利用 - Dirty Cow CVE-2016-5195 权限提升实验室 | Linux 内核漏洞利用 📋 概述 动手实验复现 DirtyCow 漏洞（CVE-2016-5195），这是一个在 Linux 内核中发现的严重竞争条件漏洞，允许非特权用户获得对只读内存映射的写入权限，从而实现完全 root 权限提升。 🎯 目标 理解如何在内核层面利用竞争条件漏洞 在受控环境中复现真实世界的权限提升攻击 分析漏洞利用行为并记录缓解策略 🛠️ 工具与环境 Kali Linux（存在漏洞的内核版本） GCC 编译器 C 漏洞利用代码（dirtycow.c） 🔬 我的操作 1. 搭建一个存在漏洞的...

CVE-2022-0847-dirty-pipe-checker

CVE-2022-0847-dirty-pipe-checker Script Bash para comprobar CVE-2022-0847 Dirty Pipe Resumen Esta es la historia de CVE-2022-0847, una vulnerabilidad en el kernel de Linux desde la versión 5.8 que permite sobrescribir datos en archivos de solo lectura arbitrarios. Esto conduce a una escalada de...

dirtypipe

Referencia: https://access.redhat.com/security/vulnerabilities/RHSB-2022-002 Diagnóstico Se ha desarrollado un script de detección de vulnerabilidades para determinar si su sistema se ve afectado actualmente por esta falla. Para verificar la autenticidad del script, también puede descargar la fir...

CVE-2026-91985

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate...

CVE-2026-91985

Vikunja before 2.6.0 contains an access-control flaw in its single-share read endpoints: the link-share hash field is not properly restricted, allowing read-only members to obtain the share's secret credential. An attacker can then exchange that hash for a link-share JWT at the share's permission...

CVE-2026-54076 ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATESCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and...

CVE-2026-54076

ArcadeDB (Multi-Model DBMS) versions prior to 26.6.1 suffer from an incomplete authorization fix for CVE-2026-44221. The UPDATE_SCHEMA permission check was added only to LocalDocumentType.createProperty, leaving other public schema mutators in LocalDocumentType.java and LocalProperty.java unprote...

CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2022-0847

CVE-2022-0847 Original link https://dirtypipe.cm4all.com/ Usage gcc exploit.cpp -o exploit ./exploitIt will spawn a root shell Vulnerability description This is CVE-2022-0847, a vulnerability in the Linux kernel since version 5.8 that allows overwriting data in arbitrary read-only files. This lea...