205 matches found
CVE-2020-1066-EXP
引用 这个漏洞属于Windows CardSpace服务未正确处理符号链接对象导致的任意文件替换的本地权限提升漏洞 申明 作者poc仅供研究目的,如果读者利用本poc从事其他行为,与本人无关 目录 toc 分析 漏洞影响范围 适用于Windows7和Windows Server 2008 R2的普通用户和开启特殊配置的IIS用户 漏洞原理分析 笔者是漏洞的提交者,漏洞更新于2020年5月.漏洞来自于Windows7和Windows Server 2008 R2的Windows...
WPTaskScheduler_CVE-2024-49039
WPTaskScheduler 持久化与 CVE-2024-49039：任务计划程序中的一个攻击面 WPTaskScheduler.dll 是任务计划程序的一个组件，自 Windows 10 1507 版本起存在。 这很可能是一个用于持久化的后门工具，经安全研究人员分析， 发现它能够绕过受限令牌沙箱、子进程限制，并提升至中等完整性。 ??? 1: 建立 RPC 连接，但受限令牌（如 Google Chrome 渲染器进程）似乎无法建立 RPC 连接， 因此它可能没什么用？不过 audio.mojom.AudioService 和 gpu-process 的绕过成功了…… 2: 似乎...
VMware VRealize Network Insight - Remote Code Execution
VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...
DiagTrackEoP
DiagTrackEoP Solo otra forma de abusar del privilegio SeImpersonate. Este PoC está basado en este blog de @crisprss. En este blog @crisprss mostró un método interesante para abusar del privilegio SeImpersonate usando AzureAttestService, que viene con versiones recientes de SQL server; el PoC se...
Kernelhub
Bienvenido a Kernelhub Prefacio La intención original de crear el proyecto es aprender, analizar e investigar las últimas vulnerabilidades del kernel sin necesidad de ver el sistema y el contenido relacionado. Este proyecto es una colección de exploits propietarios, excepto en caso de fallo de...
CVE-2026-57472
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to...
CVE-2026-57472
CVE-2026-57472 affects the KUNBUS RevPiPyLoad 0.11.0 XML-RPC management interface. A CWE-22 path traversal in the file management functionality enables a local unauthenticated attacker to delete arbitrary files with the RevPiPyLoad daemon privileges, leading to loss of configuration integrity and...
CVE-2026-57472 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to...
CVE-2026-57471
CVE-2026-57471 affects KUNBUS RevPiPyLoad 0.11.0 via the XML-RPC management interface. A path traversal flaw in the file management component allows a local unauthenticated attacker to read arbitrary files with the RevPiPyLoad daemon’s privileges by sending crafted requests to the local managemen...
EUVD-2026-58677
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...
CVE-2026-9782
Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing...
EUVD-2026-39107
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port 9001, reachable from outside the container via a Caddy reverse-proxy route at /supervisor/ on the public ingress. Combined with the...
EUVD-2026-36686
A vulnerability has been found in hcengineering Huly Platform up to 0.7.0. Affected is the function getMailboxSecret of the file server/account/src/operations.ts of the component RPC Interface. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit h...
CVE-2026-12212
The CVE concerns hcengineering Huly Platform (up to v0.7.0). It affects the RPC Interface component, specifically the getMailboxSecret function in server/account/src/operations.ts. The issue is an improper access control vulnerability that could be triggered remotely. Public disclosure of the exp...
CVE-2026-50636 LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection
The RemoteControl API methods inviteparticipants and remindparticipants pass a caller-supplied token-ID array into TokenDynamic::findUninvited, which concatenates the values directly into a tid IN '...' SQL clause without parameterization or input validation. A remote, authenticated attacker...
CVE-2025-40948
A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.17.1, RUGGEDCOM ROX MX5000RE All versions V2.17.1, RUGGEDCOM ROX RX1400 All versions V2.17.1, RUGGEDCOM ROX RX1500 All versions V2.17.1, RUGGEDCOM ROX RX1501 All versions V2.17.1, RUGGEDCOM ROX RX1510 All versions V2.17.1...
CVE-2025-40948
A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.17.1, RUGGEDCOM ROX MX5000RE All versions V2.17.1, RUGGEDCOM ROX RX1400 All versions V2.17.1, RUGGEDCOM ROX RX1500 All versions V2.17.1, RUGGEDCOM ROX RX1501 All versions V2.17.1, RUGGEDCOM ROX RX1510 All versions V2.17.1...
CVE-2025-69691
Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.execphp. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code...
CVE-2026-6942
radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2cmdstr. Attackers can inject shell metacharacters throu...
