CVE-2025-8110

CVE-2025-8110 — Gogs = 0.13.3 Arbitrary File Write via Symlink Traversal Overview Gogs = 0.13.3 is vulnerable to arbitrary file write through the PutContents API /api/v1/repos/:owner/:repo/contents/:path. The API validates file paths for directory-traversal sequences ../ but does not resolve...

CVE-2020-5902

🚨 CVE-2020-5902 — F5 BIG-IP TMUI RCE CVE-2020-5902 is a critical unauthenticated Remote Code Execution RCE vulnerability in the F5 BIG-IP Traffic Management User Interface TMUI / Configuration utility. 📌 Overview Disclosed by F5 on June 30, 2020 NVD published July 1, 2020, this flaw allowed...

Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload

Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload. id: CVE-2025-20282 info: name: Cisco ISE 3.4P2 -...

CVE-2026-119740

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...

CVE-2026-119740

The Nexbox A95X TV boxes built on the Amlogic S905X platform are vulnerable to a multi-stage attack leading to full root-level compromise. Physical attackers can access an unauthenticated console via an internal UART header on the PCB using a USB-to-TTL adapter to obtain an interactive shell as u...

EUVD-2026-115401

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...

penetration-testing-exploitation

Penetration Testing & Exploitation A black-box penetration t...

Kioptrix-Level1-Vulnerability-Analysis

Kioptrix Level 1: Full-Spectrum Vulnerability Audit & Exploitation 🏛️ Professional Objective The objective was to perform a structured penetration test on the Kioptrix Level 1 environment to achieve full 'root' compromise and document technical remediation strategies suitable for both Red and Blue...

RootQuest-CTF-Box-Multi-Stage-Exploitation-VM

RootQuest CTF Box — Multi-Stage Exploitation VM 💀 Kalaichelvan Thieveshkar CB013248 · Staffordshire University · COMP50003 - Cyber Security II Overview RootQuest is a purpose-built CTF virtual machine that contains a 10-stage , sequential attack path spanning 5 security domains. Each challenge...

CVE-2025-54322-exploit

CVE-2025-54322: XSpeeder SXZOS Pre-Auth RCE Exploit A professional Proof-of-Concept PoC exploit for CVE-2025-54322 , a critical pre-authentication remote code execution vulnerability in XSpeeder SXZOS firmware. This vulnerability was discovered and disclosed by the autonomous AI agent from pwn.ai...

CVE-2026-43284-DIRTY-FRAG-

CVE-2026-43284-DIRTY-FRAG- Detailed technical analysis of CVE-2026-43284 Dirty Frag local privilege escalation flaw in the Linux kernel. CVE-2026-43284 commonly referred to as part of the Dirty Frag vulnerability suite is a critical local privilege escalation LPE flaw in the Linux kernel. It stem...

CVE-2026-101967 Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used

An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response...

CVE-2026-11318 Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the...

PT-2026-108217

Name of the Vulnerable Software and Affected Versions Deskin versions prior to 3.3.4.4 Description A privilege escalation issue exists in the com.deskin.service.installer XPC service. Local unprivileged attackers can connect to this root-owned service without authentication to execute arbitrary...

blackbox-pentesting-infsecos

Black-Box Penetration Test — SecOS:1 VulnHub Overview Full black-box penetration test against SecOS:1 , a deliberately vulnerable CTF machine from VulnHub. Objective: simulate a real-world attacker with zero prior knowledge and achieve root-level compromise, evidenced by retrieving /root/flag.txt...

CVE-2026-87799 Arbitrary file write on LXD host via symlink in migration stream

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write...

CVE-2026-87799 Arbitrary file write on LXD host via symlink in migration stream

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write...

CVE-2026-87799

Canonical LXD versions 4.0 and later on Linux (fixed in 4.0.14, 5.0.10, 5.21.8, and 6.10) are vulnerable to an arbitrary file write due to improper link resolution in the migration receive path. An authenticated client capable of creating instances or custom storage volumes, or a malicious migrat...

CVE-2026-100713

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

CVE-2026-100716

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export DataDump cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir contains an off-by-one in its path-component walk that skips the first segment...