parallels-file-move-privesc

parallels-file-move-privesc This repository contains an exploit for CVE-2023-50226 / ZDI-CAN-21227, which can be used to escalate privileges to root using Parallels Desktop on versions before 18.3.2...

EPScalate

EPScalate An elevation of privilege vulnerability in QuickHeal's Seqrite Enterprise Endpoint Security Solution EPS. The vulnerability has been assigned a CVE ID of CVE-2023-31497. https://user-images.githubusercontent.com/39941993/230790056-87157751-b96c-49a6-81df-bf3126acfbd6.mp4 Vendor and...

CopyFail-CVE-2026-31431

CopyFail: CVE-2026-31431 Python implementation of copy.fail. Overwrites the page cache of a setuid-root binary via AFALG + splice to get root. No race, no offsets works on any Linux distro since 2017. Requirements Python 3.6+ 3.12+ uses os.splice natively; older versions fall back to ctypes Linux...

CVE-2026-53694-NoMachine-LPE

CVE-2026-53694: NoMachine Local Privilege Escalation via Argument Injection Overview This repository contains the write-up and Proof of Concept PoC for CVE-2026-53694, a Local Privilege Escalation LPE vulnerability in NoMachine for Linux. Due to improper neutralization of argument delimiters in t...

CVE-2013-2094

CVE-2013-2094 Linux 2.6.32/2.6.37 - 3.8.10 PERFEVENTS local root x86/x8664 without backconnect...

YAPS

YAPS - Y et A nother P HP S hell Yes, as the name reveals, this is yet another PHP reverse shell, one more among hundreds available out there, but with some advantages. It is a single PHP file containing all its functions and you can control it via a simple TCP listener e.g. nc -lp 1337. In the...

CVE-2020-0041

CVE-2020-0041 This repository contains LPE code for exploiting CVE-2020-0041 implemented by bluefrostsecurity as released at https://github.com/bluefrostsecurity/CVE-2020-0041/tree/master/lpe . The exploitation approach for this part can be found at...

zimbra-cve-2026-73570-ir

Zimbra CVE-2026-73570 Community IR Toolkit Detection-first, evidence-preserving incident-response helpers for Zimbra administrators investigating suspected exploitation of CVE-2026-73570. !CAUTION This is an independent community project, not a vendor compromise oracle. The checker is read-only a...

CVE-2026-0163-EXP

CVE-2026-0163 DISCLAIMER This repository is for educational and research purposes only. The author is not responsible for any misuse, damage, or illegal activities caused by the use of this material. Use at your own risk. Respect applicable laws and ethical guidelines. Overview A functional remot...

pentesting-obioba

pentesting-obioba Black box pentesting: Shellshock CVE-2014-6271 + Log4Shell CVE-2021-44228. Root escalation. Executive and technical report Pentesting Obioba — Security Audit Black Box Project of the 360° Cybersecurity Bootcamp by The Bridge Digital Talent Accelerator 2025-2026. 🎯 Objective...

CVE-2023-0386-go-poc

Go PoC of CVE-2023-0386 ./main /tmp/fuse Will run the program and create a fuse mount on "/tmp/fuse" directory. Expects you've compiled the shell in the root directory with a name of "shell" by default. After you've run the program, there should be an executable binary in the "/tmp/ovlmerged/"...

docker-socket-risk-demos

docker-socket-risk-demos Companion repo for the video: Stop Mounting docker.sock — Run Trivy Without Giving Away Root Access — inspired by CVE-2026-33634 https://www.youtube.com/watch?v=xLTYzfPY3xI This repo contains the sample web app and Claude Code prompt used in the video to demonstrate: 1. W...

CVE-2026-113678

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document...

EUVD-2026-105094

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document...

MitigationToolkit-ROSN-LR5-Full

🧬 ROSN-LR5 – Kernel LPE PoC & Mitigation Toolkit CVE-2026-31431 Offensive and defensive tool for the CVE-2026-31431 vulnerability on Linux systems. It combines a local privilege escalation LPE proof of concept with utilities to review and temporarily mitigate the AFALG-based attack vector. ⚖️...

CVE-2026-20217

ZendTo 6.15-8 / ClamAV exact-profile RCE and root-variant reproduction This directory is a standalone, authorized-lab reproduction bundle for the no-account ZendTo-to-ClamAV code-execution chain and its separate default- profile Smarty/root-cron continuation. It includes: the complete runnable Po...

CVE-2022-20186

Exploit for CVE-2022-20186 The write up can be found here. This is a bug in the Arm Mali kernel driver that I reported in January 2022. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root. The exploit is...

CVE-2025-27591-below-

CVE-2025-27591 – Privilege Escalation in Below 1 Introduction Below is a Linux tool for recording and displaying system data such as hardware utilization and cgroup metrics. In versions prior to v0.9.0 , Below’s systemd service runs with root privileges and creates world-writable log directories...

hackcar-writeup

Hackcar - Writeup Platform: DockerLabs Difficulty: Medium more or less, it has its quirks Objective: From webuser to root by breaking a Next.js The start: reconnaissance As always, first things first: see what we're up against. nmap -sC -sV -T4 172.17.0.2 PORT STATE SERVICE VERSION 8080/tcp open...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25, and 8.0.x below 8.0.12, when running PHP FPM SAPI with the main FPM daemon process running as the root user and child worker processes running as lower-privileged users, it is possible for the child processes to access memory...