CVE-2024-21626-demo

CVE-2024-21626-demo Container Runtime Meetup 5 LT용 데모입니다. 공지된 정보에 따라 공격의 위험성을 알리기 위한 목적이며, 악용은 엄격히 금지됩니다. 슬라이드 Container Runtime Meetup 5 〜그 이미지, 정말 신뢰할 수 있나요?〜 CVE-2024-21626로 호스트의 root를 탈취 victim-server에 로그인 데모용 노트북의 sshconfig에 victim-server로 등록되어 있는 머신입니다. ssh victim-server 피해를 입기 위한 전제 조건으로서의...

NextJS-RCE-Root-Takeover

🚨 Next.js 16.0.6 로 RCE 를 얻은 다음 python3 로 권한 상승 하는 방법을 알고 계신가요? 🚨 TryHackMe "Love at First Breach 2026" 대회고급 트랙의 실제 랩 을 통해 알려드리겠습니다... 📄 전체 보고서는 여기: 🔥 내부: CVE-2025-55182 → Shell PoC → 권한 상승 → Root + 조치 펜테스터: [email protected]...

CVE-2023-5521

CVE-2023-5521 KernelSU의 서명 스푸핑을 통한 루트 장악 상세 보고서 https://huntr.dev/bounties/d438eff7-4e24-45e0-bc75-d3a5b3ab2ea1/...

PT-2026-61579

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users e.g., those with the database editor role can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the...

Duplicate Advisory: SurrealDB server-takeover via SurrealQL injection on backup import

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-ccj3-5p93-8p42. This link is maintained to preserve external references. Original Description SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in...

EUVD-2025-210483

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a...

CVE-2025-71392

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a...

CVE-2025-71392 SurrealDB before 2.2.2 SurrealQL Injection via export

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a...

CVE-2025-71392 SurrealDB before 2.2.2 SurrealQL Injection via export

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a...

📄 OpenWrt 23.05 Remote Code Execution

OpenWrt version 23.05 suffers from an authenticated remote code execution vulnerability. Exploit Title: OpenWrt 23.05 - Authenticated Remote Code Execution RCE Date: 2026-01-17 Exploit Author: Ahmet Mersin Vendor Homepage: https://github.com/stangri/luci-app-https-dns-proxy Software Link:...

Linux Distros Unpatched Vulnerability : CVE-2023-22099

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 7.0.12. Easily...

PT-2026-60953

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.0.5 SurrealDB versions 2.1.x prior to 2.1.5 SurrealDB versions 2.2.x prior to 2.2.2 Description The command-line export command fails to properly escape table and field names. An authenticated System User with OWN...

Adfinis Document Merge Service Security Vulnerability

Adfinis Document Merge Service is a merged document template service from Adfinis. A security vulnerability exists in Adfinis Document Merge Service versions 6.5.1 and earlier, which stems from a remote code execution attack that allows an attacker to conduct a remote code execution attack via...

PT-2024-27459

Name of the Vulnerable Software and Affected Versions Document Merge Service versions 6.5.1 and prior Description The issue allows for remote code execution via server-side template injection, which can result in full takeover of the affected system when executed as root. This gives an attacker...

PT-2023-32151 · Tiann · Kernelsu

Name of the Vulnerable Software and Affected Versions: tiann/kernelsu versions prior to 0.6.9 Description: The issue concerns incorrect authorization in the tiann/kernelsu GitHub repository. This allows for root takeover via signature spoofing. Recommendations: For versions prior to 0.6.9, update...

Root takeover via signature spoofing

Description When an app requests "CMDBECOMEMANAGER" via prctl, couple of checks done before promoting uid as root manager. Main check relies on requester's signature. Signature control is done in checkv2signature function in kernel\apksign.c, this function accepts both V2 and V3 signatures...