GhostTask

Ghost Scheduled Task Inspired by WithSecure's research on Scheduled Task Tampering, they explained the feasibility of creating a scheduled task solely through registry key manipulation. Such an approach can bypass the generation of scheduled task creation event logs, such as 4698 and 106, providi...

PageBuilderCK-CVE-2026-56290-Exploit

Page Builder CK — fonts.save RCE Probe CVE-2026-56290 BlackHat Team proof-of-concept scanner for the Joomla Page Builder CK fonts.save vulnerability. POC CVE-2026-56290 Author: @mrzblackhat Team: BlackHat Team Credits: Peyman Siyahi · MR.PERSIA Overview This tool probes Joomla sites running the...

CVE-2024-24142

CVE-2024-24142: School-Task-Manager-System-SQL-Injection-2 Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/School-Task-Manager-System/CVE-2024-24142.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-24142/blob/main/CVE-2024-24142.md...

ctf-cve-2019-11043

Task Management APP CVE-2019-11043 Lab Minimal PHP app with intentionally vulnerable Nginx/PHP-FPM setup for reproducing CVE-2019-11043. Includes a tiny task manager, login/admin, and DB config UI. Build & Run Docker build docker build -t cve-2019-11043-lab:app . run docker run --rm -p 8080:80...

Simple Task Managing System v1.0 - SQL Injection

SQL injection occurs when a web application doesn't properly validate or sanitize user input that is used in SQL queries. Attackers can exploit this by injecting malicious SQL code into the input fields of a web application, tricking the application into executing unintended database queries. id:...

Kestra <= 1.3.20 - Remote Code Execution

Kestra = 1.3.20 contains an authentication bypass caused by misclassification of /configs endpoint in REST API filter, letting unauthenticated attackers create and execute root-level tasks, exploit requires unauthenticated access to /configs endpoint. id: CVE-2026-53576 info: name: Kestra = 1.3.2...

persistence-info.github.io

The repository tries to gather an information about Windows persistence mechanisms to make the protection/detection more efficient. Most of the information is well known for years, being actively used within various scenarios. Expect more. I am doing my best to add new entries each day. How it...

CVE-2024-24141

CVE-2024-24141: School-Task-Manager-System-SQLInjection-1 Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/School-Task-Manager-System/CVE-2024-24141.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-24141/blob/main/CVE-2024-24141.md...

CVE-2025-60710

CVE-2025-60710 This is PoC for local privilege escalation vulnerability in \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration scheduled task. When this scheduled task is started the taskhostw.exe process whill try to open the C:\Users%username%\AppData\Local\CoreAIPlatform.00\UKP directory...

CVE-2026-98536

A flaw was found in the Linux kernel's writeback subsystem. This vulnerability can lead to a Denial of Service DoS when the routine responsible for cleaning up offline control group writeback structures fails to report a quiescent state during extended cleanup passes under certain preemption...

CVE-2026-111061

A flaw was found in russh. When processing key addition requests containing lifetime constraints, the Secure Shell SSH agent server spawns a separate long-lived task for repeated constraint records and fails to roll back tasks if subsequent parsing fails. An attacker capable of communicating with...

GO-2026-6731 Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6726 Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/api

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

WPTaskScheduler_CVE-2024-49039

WPTaskScheduler Persistence & CVE-2024-49039, as one of Attack Surface within Task Scheduler. WPTaskScheduler.dll is a component of Task Scheduler, since win 10 1507. This is likely a backdoor tool used for persistence, which was analyzed by security researchers, who found that able to bypass...

CVE-2023-31705

CVE-2023-31705 description A Reflected Cross-site scripting XSS vulnerability in Sourcecodester Task Reminder System 1.0 allows an authenticated user to inject malicious javascript into the page parameter. Vulnerability Type Cross Site Scripting XSS Vendor of Product Sourcecodster Affected Produc...

CVE-2026-27495

CVE-2026-27495 — n8n JS Task Runner Sandbox Escape Sandbox escape on n8n JavaScript Task Runner via host-realm object leak. | ---|--- CVE| CVE-2026-27495 CVSS| 9.4 Critical CWE| CWE-94 — Code Injection Affected| n8n 1.123.22 / 2.0.0–2.9.2 / 2.10.0 Fixed| 1.123.22 / 2.9.3 / 2.10.1 Attack Surface|...

CVE-2026-112305

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

ring3-kit

ring3-kit Hides Process From Task Manager Using NT Hooking NtQuerySystemInformation. A simple Ring-3 user mode rootkit. How Hook the API function NtQuerySystemInformation with our own function that hides a process from task manager Hooked function gets called instead The DLL is injected into...

EUVD-2026-104397

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-43499

CVE-2026-43499 Exploitation Notes Severity: HIGH CVSS: 7.8 Impact: Confidentiality, Integrity, Availability Published: 2026-05-21 Technical Summary CVE-2026-43499 is a vulnerability within the Linux kernel, specifically affecting the rtmutex component, which is responsible for managing real-time...