205 matches found
CVE-2020-1066-EXP
인용 이 취약점은 Windows CardSpace 서비스가 심볼릭 링크 객체를 올바르게 처리하지 않아 발생하는 임의 파일 교체 로컬 권한 상승 취약점입니다. 고지 저자의 poc는 연구 목적으로만 제공됩니다. 독자가 이 poc를 활용하여 다른 행위를 하는 경우 작성자와 무관합니다. 목차 toc 분석 취약점 영향 범위 Windows 7 및 Windows Server 2008 R2의 일반 사용자와 특수 구성을 활성화한 IIS 사용자에게 적용됩니다. 취약점 원리 분석 필자는 이 취약점의 제출자이며, 취약점은 2020년 5월에...
WPTaskScheduler_CVE-2024-49039
WPTaskScheduler 持久化与 CVE-2024-49039：任务计划程序中的一个攻击面 WPTaskScheduler.dll 是任务计划程序的一个组件，自 Windows 10 1507 版本起存在。 这很可能是一个用于持久化的后门工具，经安全研究人员分析， 发现它能够绕过受限令牌沙箱、子进程限制，并提升至中等完整性。 ??? 1: 建立 RPC 连接，但受限令牌（如 Google Chrome 渲染器进程）似乎无法建立 RPC 连接， 因此它可能没什么用？不过 audio.mojom.AudioService 和 gpu-process 的绕过成功了…… 2: 似乎...
VMware VRealize Network Insight - Remote Code Execution
VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...
DiagTrackEoP
DiagTrackEoP 这只是滥用 SeImpersonate 权限的另一种方式。 本 PoC 基于 @crisprss 的这篇博客。 在这篇博客中，@crisprss 展示了一种使用 AzureAttestService 滥用 SeImpersonate 权限的有趣方法，AzureAttestService 随近期版本的 SQL Server 一起提供，相关 PoC 可在此处找到：https://github.com/crisprss/magicAzureAttestService。 在同一篇博客中，他还展示了另一种利用 DiagTrack 服务滥用 SeImpersonate...
Kernelhub
Kernelhub へようこそ はじめに このプロジェクトを制作した本来の目的は、最新のカーネル脆弱性を学習・分析・研究する際に、システムや関連コンテンツを確認する必要がないようにすることです。 このプロジェクトは、テストに失敗したものや未指定のものを除いた、専有のExp、Demo GIF画像のコレクションです。 CVE脆弱性に漏れがある場合は、利用コードを添えてissuesにお知らせください。 本プロジェクトのコードは実環境でのテストを禁止します！コードの信頼性は自己責任で検証してください。発生した障害の原因については一切責任を負いません。 中文文档 | 英語ドキュメント...
CVE-2026-57472
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to...
CVE-2026-57472
CVE-2026-57472 affects the KUNBUS RevPiPyLoad 0.11.0 XML-RPC management interface. A CWE-22 path traversal in the file management functionality enables a local unauthenticated attacker to delete arbitrary files with the RevPiPyLoad daemon privileges, leading to loss of configuration integrity and...
CVE-2026-57472 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to...
CVE-2026-57471
CVE-2026-57471 affects KUNBUS RevPiPyLoad 0.11.0 via the XML-RPC management interface. A path traversal flaw in the file management component allows a local unauthenticated attacker to read arbitrary files with the RevPiPyLoad daemon’s privileges by sending crafted requests to the local managemen...
EUVD-2026-58677
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...
CVE-2026-9782
Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing...
EUVD-2026-39107
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port 9001, reachable from outside the container via a Caddy reverse-proxy route at /supervisor/ on the public ingress. Combined with the...
EUVD-2026-36686
A vulnerability has been found in hcengineering Huly Platform up to 0.7.0. Affected is the function getMailboxSecret of the file server/account/src/operations.ts of the component RPC Interface. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit h...
CVE-2026-12212
The CVE concerns hcengineering Huly Platform (up to v0.7.0). It affects the RPC Interface component, specifically the getMailboxSecret function in server/account/src/operations.ts. The issue is an improper access control vulnerability that could be triggered remotely. Public disclosure of the exp...
CVE-2026-50636 LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection
The RemoteControl API methods inviteparticipants and remindparticipants pass a caller-supplied token-ID array into TokenDynamic::findUninvited, which concatenates the values directly into a tid IN '...' SQL clause without parameterization or input validation. A remote, authenticated attacker...
CVE-2025-40948
A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.17.1, RUGGEDCOM ROX MX5000RE All versions V2.17.1, RUGGEDCOM ROX RX1400 All versions V2.17.1, RUGGEDCOM ROX RX1500 All versions V2.17.1, RUGGEDCOM ROX RX1501 All versions V2.17.1, RUGGEDCOM ROX RX1510 All versions V2.17.1...
CVE-2025-40948
A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.17.1, RUGGEDCOM ROX MX5000RE All versions V2.17.1, RUGGEDCOM ROX RX1400 All versions V2.17.1, RUGGEDCOM ROX RX1500 All versions V2.17.1, RUGGEDCOM ROX RX1501 All versions V2.17.1, RUGGEDCOM ROX RX1510 All versions V2.17.1...
CVE-2025-69691
Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.execphp. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code...
CVE-2026-6942
radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2cmdstr. Attackers can inject shell metacharacters throu...
