EUVD-2026-92187

In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11242428; Issue ID: MSV-9038...

CVE-2026-20536

In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11242428; Issue ID: MSV-9038...

CVE-2026-20536

A memory corruption vulnerability exists in aidl due to a use after free condition. This flaw could allow a malicious actor with System privileges to achieve a local escalation of privilege . Exploitation does not require user interaction. Remediation is addressed in Patch ID: ALPS11242428 (Issue...

CVE-2026-20535

In aidl, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11185216; Issue ID: MSV-9039...

EUVD-2026-92199

In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9800...

CVE-2026-20579

A vulnerability in vdec allows for an out of bounds write caused by type confusion . This flaw could lead to a local escalation of privilege if an attacker has already secured System privileges. Exploitation does not require user interaction. Remediation information is available via Patch ID: ALP...

CVE-2026-50656-rogueplanet-validation

RoguePlanet PoC Validation Report for Microsoft Defender Purpose and scope of the report This report concerns the validation of the publicly described RoguePlanet PoC related to Microsoft Defender. The described technique was presented in the media on 10 June 2026 as a Local Privilege Escalation...

IDiagnosticProfileUAC

IDiagnosticProfileUAC Just another UAC bypass using auto-elevated COM object Virtual Factory for DiagCpl 12C21EA7-2EB8-4B55-9249-AC243DA8C666. This COM object can be used to create instance of DiagnosticProfile D0B7E02C-E1A3-11DC-81FF-001185AE5E76 COM object which exposes SaveDirectoryAsCab metho...

PrintNightmare-CVE-2021-34527

PrintNightmare - Windows Print Spooler RCE/LPE Vulnerability CVE-2021-34527, CVE-2021-1675 Summary This is a remote code execution vulnerability that can be used to obtain SYSTEM level privileges by an authenticated remote user against Windows machines running the print spooler service. An attack...

Windows-WinSock-UAF-Mitigation

CVE-2026-68820: Windows WinSock afd.sys UAF Mitigation This repository contains a conceptual patch demonstrating the mitigation for CVE-2026-68820 , a critical Use-After-Free UAF vulnerability in the Windows Ancillary Function Driver for WinSock afd.sys. Active exploitation of this flaw allows a...

cve-2014-7912

cve-2014-7911 Эксплойт для cve-2014-7911, позволяющий получить системные привилегии, основан на большей части кода других, но с другим гаджетом 1. установите apk и нажмите кнопку 2. системный сервер перезапустится 3. запишет системный id100 в /data/1.txt...

CVE-2026-18782-TREX-MES-Uygulamalarinda-SQL-Zafiyeti

TREX-MES-Uygulamalarında-SQLi-Zafiyeti CVE-2026-18782 Обзор TREX MES — это коммерческая платформа системы управления производством MES / Индустрии 4.0, используемая для сбора и управления данными с производственного участка. Веб-API приложения выполняет параметр sql , поступающий от клиента,...

BadSamba

DESCRIPTION This module is used to exploit startup script execution through Windows Group Policy settings when configured to run off of a remote SMB share. Windows Group Policy can be used to configure startup scripts that will execute each time the operating system powers on. These scripts execu...

Disable-TamperProtection

Disabling Tamper Protection and other Defender / MDE components It is possible to abuse SYSTEM / TrustedInstaller privileges to tamper or delete WdFilter settings ALTITUDE regkey and unload the kernel minidriver to disable Tamper protection and other Defender components. This also affects...

TokenStealer

TokenStealer A simple tool I wrote some time ago for stealing and playing with Windows tokens. Parts of code have been taken and adatpted from https://github.com/FSecureLABS/incognito Clearly, you will require Impersonation or AssignPrimary privilege and Debug privilege to access all processes...

avscript

Avast Antivirus JavaScript Interpreter NOTE: On 03/11/2020 Avast announced they had decided to disable this interpreter globally! The main Avast antivirus process is called AvastSvc.exe, which runs as SYSTEM. That service loads the low level antivirus engine, and analyzes untrusted data received...

CVE-2025-59287

CVE-2025-59287 WSUS RCE Exploit Automated exploit for Windows Server Update Services WSUS unauthenticated remote code execution vulnerability. Vulnerability Details CVE ID: CVE-2025-59287 CVSS Score: 9.8 Critical Attack Vector: Network Authentication: None required Impact: Remote Code Execution a...

WSUS-RCE-Mitigation-59287

🚨 CRITICAL CYBERSECURITY ALERT: RCE in WSUS CVE-2025-59287 🚨 CREATOR AND CREDITS: @esteban11121 This guide has been created to help the community quickly mitigate the vulnerability. STATUS: Active Exploitation In-the-Wild Confirmed. This is a Remote Code Execution RCE vulnerability affecting WSUS...

CVE-2025-59287-When-your-patch-server-becomes-the-attack-vector

CVE-2025-59287 — When your patch server becomes the attack vector 🗿 TL;DR: Microsoft patched a critical unauthenticated remote code execution RCE vulnerability in Windows Server Update Services WSUS that’s already being exploited in the wild. The issue stems from unsafe deserialization of...

CVE-2025-4632_POC

Samsung MagicINFO 9 Server Exploit CVE-2025-4632 This repository contains a Python replication script for CVE-2025-4632, an Unauthenticated Remote Code Execution RCE vulnerability in Samsung MagicINFO 9 Server versions prior to 21.1052. The vulnerability exists due to an improper limitation of a...