pkwned

pkwned: Proof of Concept for CVE-2021-4034 This PoC will run PAYLOADPATH as defined in constants.h with root privileges from a vulnerable version of pkexec running on glibc. The directory "GCONVPATH=." needs to contain an executable file named after the directory containing the gconv module. As...

CVE-2023-26866

CVE-2023-26866 Description GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerable to remote command injection. Commands are executed using pre-login execution and executed with root privileges allowing complete...

CVE-2026-46368-OpenWrt-Exploit

OpenWrt luci-app-https-dns-proxy Authenticated Command Injection CVE-2026-46368 This repository contains the Proof of Concept PoC exploit for a critical OS command injection vulnerability in luci-app-https-dns-proxy that results in arbitrary command execution as root. CVE ID: CVE-2026-46368...

CVE-2025-65753

CVE-2025-65753 Proof of concept for CVE-2025-65753: Remote code execution on the Gryphon Guardian access point, firmware version 01.06.0006.22, through an improper TLS certificate validation. Description The Gryphon Guardian WiFi access point, with firmware version 01.06.0006.22, does not properl...

TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Server Address Reachi — Detect

Fingerprint / reachability check for TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Server Address Reaching Root Execution Through a Shell-Form system Call CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Serv...

TRENDnet TV-IP302PI NTP address command injection RCE

Authenticated CGI/ONVIF SetNTP: msntp -r sink with semicolon/command substitution in NtpIP / hostname field. """TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Server Address Reaching Root Execution Through a Shell-Form system Call CWE-78""" from future import annotations from types...

webos-downloadmanager-root

webos-downloadmanager-root Candidate root chain on LG webOS T...

CVE-2026-111229

Netgate pfSense CE versions 2.7.0 through 2.9.0 are vulnerable to a command injection flaw in the services_captiveportal_hasync.php component. The vulnerability arises because captiveportal_load_pfctl passes unescaped shell metacharacters from an XMLRPC server to a pfctl shell command. Specifical...

EUVD-2026-102334

Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add autoprependfile pointing at /var/db/zoneinfo,...

CVE-2026-111221

Netgate pfSense CE versions through 2.9.0 are vulnerable to a configuration injection flaw. Authenticated WebGUI users with L2TP or PPPoE Server edit privileges can perform a command injection by submitting an unescaped RADIUS shared secret . By sending a secret containing a quote and newline to ...

Astra Linux – Vulnerability in Systemd

In udev under systemd, before version 260, local root execution could occur through malicious hardware devices and unsanitized kernel output...

CVE-2026-111222: Improper Neutralization of CRLF Sequences

Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add autoprependfile pointing at /var/db/zoneinfo,...

CVE-2026-73802 Gitea Runner host isolation bypass through container options

Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to...

CVE-2026-81498

Summary Impact The "nvidia.driver.capabilities" instance configuration key in Incus uses "validate.IsAny" at "internal/instance/config.go:744", which accepts any input without filtering. The value is subsequently written to the generated "lxc.conf" file at...

CVE-2026-81495

Summary "POST /1.0/storage-pools//volumes" with an "application/octet-stream" body custom-volume ISO or backup import uses an attacker-controlled name as an on-disk path segment without validation. A project user with the "cancreatestoragevolumes" entitlement can supply "X-Incus-name: ../../../.....

Exploit for Use After Free in Google Android

cve-2019-2215-oppo-a77t ⚠️ Includes binary source code, scrip...

Linux Distros Unpatched Vulnerability : CVE-2026-102282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm- zip applies the Unix permission bits stored in a zip...

CVE-2026-102282

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via "fs.chmodSync" when "keepOriginalPermission=true" is passed to "extractAllTo"/"extractEntryTo" — a...

EUVD-2026-92493

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

CVE-2026-102282: Incorrect Permission Assignment for Critical Resource

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...