117 matches found
EventViewerUAC_BOF
EventViewerUACBOF This is a Beacon Object File implementation of the Event Viewer deserialization UAC bypass discovered by @orange8361 and the POC put together by CsEnox. Tested on x64 Win10/Win11 OPSEC WARNINGS! This UAC bypass performs the following actions which should be considered in referen...
CIRCUTOR PowerStudio SCADA WAVE Unauthenticated shellExecute SYSTEM RCE — Detect
Fingerprint / reachability check for CIRCUTOR PowerStudio SCADA WAVE Unauthenticated shellExecute SYSTEM RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for CIRCUTOR PowerStudio SCADA WAVE Unauthenticated shellExecute SYSTEM RCE""" from kittysploit import from...
Circutor LineEds pwrstudio shellExecute unauth RCE
PUT/POST armed events.xml then GET restart/reloadCfg; sink runs system"x ;CMD;" as root on many deployments. """Circutor LineEds pwrstudio unauthenticated shellExecute event injection RCE.""" from future import annotations import re from kittysploit import from lib.protocols.http.httpclient impor...
CIRCUTOR PowerStudio JWT alg=none forgery
Forge alg=none Admin JWT and access protected admin/microservice routes. When events.xml accepts the token, delivers shellExecute for Windows cmd/payload. """CIRCUTOR PowerStudio JWT alg=none admin forgery auth bypass chain primitive.""" from future import annotations import base64 import json...
CIRCUTOR PowerStudio shellExecute SYSTEM RCE
JWT admin PUT reload + SSH upload default.xeve with shellExecute cmd.exe. Requires sshkey to Windows target. """CIRCUTOR PowerStudio SCADA WAVE Unauthenticated shellExecute SYSTEM RCE""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import Httpclient...
Windows UAC Bypass — CMSTPLUA COM
UAC bypass via CMSTPLUA COM object ShellExecute runas — CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import UACAGENT, UacBypassMixin class ModulePost, UacBypassMixin: info = "name": "Windows UAC Bypas...
CVE-2026-52884
Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory does NOT canonicalize the path before checking. It uses a prefix-based check PathIsPrefix or equivalent that matches paths starting with trusted directory strings. A path traversal using ....\ after a truste...
CVE-2026-48778
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag in config.xml is read by NppXml::value Parameters.cpp:6430 and stored in nppGUI.commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDMFILEOPENCMD File → Open...
EUVD-2026-39907
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag in config.xml is read by NppXml::value Parameters.cpp:6430 and stored in nppGUI.commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDMFILEOPENCMD File → Open...
CVE-2026-48778
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag in config.xml is read by NppXml::value Parameters.cpp:6430 and stored in nppGUI.commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDMFILEOPENCMD File → Open...
CVE-2026-48800
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag text content inside in shortcuts.xml is read by NppXml::valueaNode Parameters.cpp:3658 in the feedUserCmds function and stored in UserCommand.cmd without any validation. When the user clicks the corresponding entry ...
CVE-2026-48800
Notepad++ prior to 8.9.6.1 is affected by CVE-2026-48800 where the content inside in shortcuts.xml is read without validation and used to build a Run menu item that ShellExecute() executes. The attacker-controlled string becomes the executable path when the user clicks the Run menu entry, enabl...
CVE-2026-52884
Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory does NOT canonicalize the path before checking. It uses a prefix-based check PathIsPrefix or equivalent that matches paths starting with trusted directory strings. A path traversal using ....\ after a truste...
CVE-2026-52884 Notepad++: CVE-2026-48800 Bypass
Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory does NOT canonicalize the path before checking. It uses a prefix-based check PathIsPrefix or equivalent that matches paths starting with trusted directory strings. A path traversal using ....\ after a truste...
CVE-2026-52884 Notepad++: CVE-2026-48800 Bypass
Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory does NOT canonicalize the path before checking. It uses a prefix-based check PathIsPrefix or equivalent that matches paths starting with trusted directory strings. A path traversal using ....\ after a truste...
CVE-2026-48800: Improper Neutralization of Special Elements used in an OS Command
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag text content inside in shortcuts.xml is read by NppXml::valueaNode Parameters.cpp:3658 in the feedUserCmds function and stored in UserCommand.cmd without any validation. When the user clicks the corresponding entry ...
CVE-2026-48778: Improper Neutralization of Special Elements used in an OS Command
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag in config.xml is read by NppXml::value Parameters.cpp:6430 and stored in nppGUI.commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDMFILEOPENCMD File → Open...
CVE-2026-52884: Path Equivalence: 'filename.' (Trailing Dot)
Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory does NOT canonicalize the path before checking. It uses a prefix-based check PathIsPrefix or equivalent that matches paths starting with trusted directory strings. A path traversal using ....\ after a truste...
CVE-2025-63680
Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw CWE-22 that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a...