kernel-mii

Base del Beacon Object File di Cobalt Strike per l'exploitation del kernel tramite CVE-2021-21551. Creato da Tijme. Ringraziamenti a Alex per avermi insegnato! Reso possibile da Northwave Security Descrizione Questo è un Beacon Object File BOF di Cobalt Strike CS che sfrutta CVE-2021-21551...

cve-2026-29923

CVE-2026-29923 — pstrip64.sys Escalation dei Privilegi Locale Una proof-of-concept minimale per CVE-2026-29923, una vulnerabilità nel driver del kernel pstrip64.sys EnTech Taiwan PowerStrip ≤ 3.90.736 che consente a un processo in modalità utente non privilegiato di elevarsi a NT AUTHORITY\SYSTEM...

CVE-2024-30804

ASUS Driver LPE PoC Physical Memory Abuse Это PoC для локального повышения привилегий LPE , использующий драйвер AsInsHelp64.sys. Он злоупотребляет легитимным, подписанным драйвером ASUS для отображения физической памяти и перезаписи токенов ядра, в конечном итоге получая привилегии NT...

CVE-2025-29824-Exploit

🚨 CVE-2025-29824 Exploit: Cadeia de Ransomware PipeMagic 📌 Visão Geral da Vulnerabilidade Crítica Falha de Escalação de Privilégio no CLFS do Windows → Sequestro de Privilégio SYSTEM Explorado em Ataques Ativos de Ransomware pelo Grupo de Ameaça Storm-2460 🖥️ Sistemas Afetados Expandir Lista de...

amd-ryzen-master-driver-v17-exploit

Beacon Object File do Cobalt Strike para exploração de kernel usando o AMD Ryzen Master Driver versão 17. Construído por Tijme. Créditos ao Alex por me ensinar! Possibilitado pela Northwave Security Descrição Este é um Beacon Object File BOF e executável do Cobalt Strike CS que explora o AMD Ryze...

CVE-2026-14548

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

CVE-2026-14548

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

EUVD-2026-55947

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

CVE-2026-14548

The CVE concerns the Ray Enterprise Translation WordPress plugin (affected:

PT-2026-70065

Name of the Vulnerable Software and Affected Versions Ray Enterprise Translation versions prior to 1.7.4 Description The Ray Enterprise Translation WordPress plugin fails to perform capability or nonce checks on an AJAX action. This allows any authenticated user, such as those with Subscriber...

CVE-2026-17023

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Goog...

CVE-2026-17023 Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Goog...

CVE-2026-17023

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Goog...

CVE-2026-70474 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...

CVE-2026-11882

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...

CVE-2026-11882

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...

CVE-2026-11882

Builderall for WordPress plugin prior to version 3.0.2 contains an OAuth state handling flaw: it does not bind the OAuth flow state to the initiating user session, enabling unauthenticated attackers to finish the connection flow and overwrite the stored third‑party integration access token. A dur...

EUVD-2026-51697

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...

CVE-2026-11882 Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable...

CVE-2026-16587

The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...