CVE-2021-28476

CVE-2021-28476: a guest-to-host "Microsoft Hyper-V Remote Code Execution Vulnerability" in vmswitch.sys. This is a proof of concept for CVE-2021-28476 "Hyper-V Remote Code Execution Vulnerability", an arbitrary memory read in vmswitch.sys network virtualization service provider patched by Microso...

Linux Distros Unpatched Vulnerability : CVE-2026-84969

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a...

UBUNTU-CVE-2026-84969

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no...

bluekeep_CVE-2019-0708_poc_to_exploit

Note: This project has been archived as actual exploits have been developed elsewhere with better success. https://blog.rapid7.com/2019/09/06/initial-metasploit-exploit-module-for-bluekeep-cve-2019-0708/ Badges bluekeepCVE-2019-0708poctoexploit Porting BlueKeep PoC from @Ekultek & @umarfarook882 ...

readable-thrift

Readable Thrift Readable Thrift makes binary Thrift protocol messages easy to work with by converting them to and from a human-friendly format. This makes manual analysis of and tampering with binary format Thrift messages just as easy as working with plaintext protocols like HTTP. The library is...

Zapscape

The KVM Escape Trilogy ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape: Guest-to-Host Escape in KVM/x86 Abstract This document describes the Zapscape CVE-2026-64561 vulnerability discovered and reported by Hyunwoo Kim @v4bel. It is a KVM escape...

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Summary Semaphore resolves a project member's effective permissions in ProjectMiddleware by looking up a role row whose slug matches the member's assigned role, and overwrites the built-in permission bitmask with that row's value. A member holding the built-in manager role creates a custom projec...

CSRF-to-RCE-on-Backdrop-CMS

CSRF to RCE on Backdrop CMS 1.20 This PoC describe how to exploit CSRF on Backdrop CMS Version 1.20 with escalation to RCE. CVE ID CVE-2021-45268 Description The Backdrop CMS version 1.20 allows plugins to be added via ZIP files uploaded to the site. And because it does not have anti-CSRF...

CVE-2026-84969

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no...

CVE-2026-84963

CVE-2026-84963 affects the JSON-to-BSON parser in the MongoDB C Driver's BSON library . The root cause is an unchecked int cast of huge JSON string values, causing an incorrect numeric conversion that silently shortens unusually large text values or omits the corresponding field entirely—while th...

CVE-2026-84969

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no...

CVE-2026-84969

CVE-2026-84969 is a heap buffer overflow in the BSON-to-JSON conversion helpers of the MongoDB C Driver . The root cause is a truncated Base64 encoding of a binary field when the output is cut short at a caller-configured length limit, causing a small number of bytes to be written past the end of...

EUVD-2026-70508

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no...

CVE-2024-5932

PoC for CVE-2024-5932 Credit goes to: https://github.com/EQSTLab/CVE-2024-5932 https://www.rcesecurity.com/2024/08/wordpress-givewp-pop-to-rce-cve-2024-5932/ This PoC is provided for educational purposes only. I do not take any responsibility for the improper use of this code, especially in...

Januscape-Hotfix

Januscape Fix Library — CVE-2026-53359 简体中文 Complete fix collection for the CVE-2026-53359 guest-to-host escape vulnerability in the KVM/x86 shadow MMU. From zero-downtime livepatch to kernel upgrade — covers every operational scenario. One-liner root@kitploit: Direct curl -sL...

CVE-2026-66804-CrossDevice-Service-EoP

CVE-2026-66804: Cross Device Virtual Camera EoP I independently discovered and reported the issue now tracked as CVE-2026-66804. MSRC confirmed my submission as a duplicate of an earlier report with the same underlying Windows Camera FrameServer root cause. A standard Windows user can create a...

CVE-2026-73570

CVE-2026-73570 PoC - SMTP Command Injection Tester A custom, low-level Python proof-of-concept PoC script for testing SMTP command injection vulnerabilities CVE-2026-73570. This tool sends a malformed RCPT TO address containing shell-style command substitution e.g., $command to determine if the...

CVE-2021-30955-POC

CVE-2021-30955 POC Proof of concept wrapped into an iOS app for CVE-2021-30955 All credit to Jake James. His POC code used in this project can be found here. What is this? This demonstrates CVE-2021-30955, an iOS bug which allows an app in userspace to gain kernel-level permissions. In order to...

CVE-2021-28476

CVE-2021-28476: Hyper-V vmswitch.sys arbitrary pointer dereference from guest VM Summary: A Hyper-V guest virtual machine can trigger a Denial-of-Service condition on its underlying host due to unsafe parsing of input by the VmsIfrInfoParamsOIDSWITCHNICREQUEST function in vmswitch.sys. The crash ...

Exploit-LPE-CVE-2026-21721

💥 CVE-2026-21721 Exploit Wrote an exploit for CVE-2026-21721 and tested it on a test bench. 🎯 What's inside A combat privilege escalator: logs in, reads permissions, writes Admin permission=4 on all dashboards. A valid account with Editor rights is required for exploitation. 🧪 Tested on a test...