CVE-2024-32002-EXP

CVE-2024-32002-EXP !/bin/bash 设置 Git 配置选项 git config --global protocol.file.allow always git config --global core.symlinks true 避免警告消息（设置默认分叉为main） git config --global init.defaultBranch main 定义 tell-tale 路径 telltalepath="$PWD/tell.tale" 初始化 hook 仓库 git init hook cd hook mkdir -p y/hooks 将恶意代码写入...

CVE-2024-44258

CVE-2024-44258: Symlink Vulnerability in ManagedConfiguration Framework Summary CVE-2024-44258 highlights a symlink vulnerability within the ManagedConfiguration framework and the profiled daemon in Apple devices. When restoring a crafted backup, the migration process fails to validate whether th...

CVE-2025-24104

CVE-2025-24104 Writeup: Reading Files Out-of-Sandbox I reported a bug that Apple later tracked as CVE-2025-24104. In my original report, I demonstrated how a malicious backup could be used to bypass sandbox restrictions. However, Apple’s initial description stated that this vulnerability could le...

CVE-2024-50404

CVE-2024-50404 https://www.qnap.com/en/security-advisory/qsa-24-48 https://www.cve.org/CVERecord?id=2024-50404 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 6.8 "A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow...

ZigRaceExploit

CVE-2021-25741 — TOCTOU Symlink Race Exploit in Zig Educational exploit of the TOCTOU Time Of Check, Time Of Use race condition behind CVE-2021-25741, a vulnerability in the Kubernetes kubelet. The project demonstrates locally without a K8s cluster how a concurrent symlink swap can bypass a path...

CVE-2025-27591

CVE-2025-27591 – Privilege Escalation via Symlink Abuse in below 🛑 Disclaimer : This exploit is provided for educational and authorized security testing only. Unauthorized use may be illegal. 🧠 Overview below is a performance monitoring tool developed by Facebook for Linux systems. Versions of...

CVE-2025-27591-below-

CVE-2025-27591 – Privilege Escalation in Below 1 Introduction Below is a Linux tool for recording and displaying system data such as hardware utilization and cgroup metrics. In versions prior to v0.9.0 , Below’s systemd service runs with root privileges and creates world-writable log directories...

CVE-2025-55130

CVE-2025-55130 - Node.js Permission Model Symlink Escape / | | | | |/ \ / \ | | | | / | // \ | | || | || || || | | | | \ | \ \ | | | | | | |/|| \ ||| ||/||| | || | || | |/ |//||// Node.js Permission Model Bypass via Crafted Symlinks Discovered by natann @ JFrog Overview A path traversal flaw in...

7Ziprowler

7-ZiProwler CVE-2025-11001 Overview Result of my quick research on CVE-2025-11001 are presented in this repo. Exploit is written in python and astral uv project manager. References Some: NIST ZDI CVE News WIZ Quick analysis I will not dig too deep into technical details of this security flaw. If...

RegPwnBOF

RegPwn BOF Cobalt Strike BOF port of the RegPwn exploit by Filip Dragovic @Wh04m1001 / MDSec ActiveBreach. This is a sloppy BOF reimplementation of the original C exploit. All credit for the vulnerability research and exploit goes to Filip Dragovic and MDSec. Blog post :...

cve-2024-32002-poc-rce

CVE-2024-32002 RCE POC A POC for CVE-2024-32002 demonstrating Remote Code Execution RCE. See cve-2024-32002-poc-rce for the related submodule repository. What this repo contains A symlink with an arbitraty name that links to the .git directory. A .gitmodules file that defines the malicious...

CVE-2026-14361

CVE-2026-14361 Consul Template's writeToFile helper opened an operator-supplied destination directly and followed linked path components, allowing rendered output to escape the intended directory and overwrite a preexisting file. Intro I found this issue while reviewing HashiCorp Consul Template ...

CVE-2018-1000117-Exploit

CVE-2018-1000117 Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python...

CVE-2025-47181

CVE-2025-47181 Concept: Microsoft Edge Link Following Privilege Escalation Project Overview This repository presents the CVE-2025-47181 Concept , a Python program designed to illustrate the mechanism and impact of CVE-2025-47181. This is a Privilege Escalation vulnerability in Microsoft Edge...

CVE-2023-40028

CVE-2023-40028 PoC Exploit Symlink Upload Vulnerability in Ghost CMS Leading to Arbitrary File Read POC Image Vulnerability Details CVE-2023-40028 is a vulnerability in Ghost CMS versions prior to 5.59.1 , where authenticated users can upload symbolic links symlinks that lead to arbitrary file...

CVE-2023-40028

CVE-2023-4002 Ghost-Arbitrary-File-Read : The username/email for the target Ghost CMS. --password : The password for the target Ghost CMS. --url : The URL of the target Ghost CMS e.g., http://website.com. 1. Login: The script authenticates with the Ghost CMS admin API and retrieves a session...

CVE-2024-32002-Reverse-Shell

CVE-2024-32002-Reverse-Shell This script demonstrates how to exploit CVE-2024-32002 to obtain a reverse shell, providing remote access to the affected system. Use it with caution in controlled environments and only for educational or security testing purposes. Blog Post This script is inspired by...

CVE-2025-27591-PoC

CVE-2025-27591 PoC: Local Privilege Escalation in Below v0.9.0 Proof of Concept for CVE-2025-27591, a vulnerability that allows to local unprivileged users to escalate their privileges to root through symlink attacks. 🕵️‍♂️ Technical Details The vulnerability affects the Below service versions...

POC-CVE-2024-44258-Py

Conceptual PoC CVE-2024-44258: Symlink Vulnerability in iOS Requirement: Python 3.7+ • License: MIT ⚠️ Warning: This repository contains a proof-of-concept PoC developed for exclusively educational and research purposes. It is not a fully functional exploit. Its use on devices without proper...

SparstanBoogie

SparstanBoogie's origins were tested reportedly on iOS/iPadOS 15.2 - 16.7 RC 20H18 and 17.0 however, tests have been conducted up to 26.1 26.1. Also any testing on devices above or under whats been reported is welcomed as it may come back in newer devices so theres no reason to shrug off any good...