CVE-2026-36981-Kernel-EoP-PoC

CVE-2026-36981-Kernel-EoP-PoC MiniTool 的 pwdrvio.sys 内核驱动中存在内核写-写-何处（write-what-where）条件。演示了一种借助调试器实现的任意内核写入原语，可用于权限提升。 2026-02-09 已通知厂商 2026-03-05 厂商已确认 2026-03-05 已向 MITRE 申请 CVE 2026-05-10 在 90 天协调披露期后公开披露 https://github.com/user-attachments/assets/ac81d7ce-0be7-40a5-9334-c54350e6e30e 任意内核写入 →...

CVE-2024-53900

CTF Challenge - Mongoose RCE CVE-2024-53900 Challenge Overview 这个 Capture The Flag CTF 挑战基于 CVE-2024-53900，该漏洞存在于 Mongoose 中，由于在 MongoDB 查询中不当使用 $where 运算符，导致远程代码执行（RCE）。 你的目标是利用该漏洞，并获取隐藏在应用程序中的 flag！ Setup Instructions 1 安装依赖 确保已安装 Node.js，然后运行： root@kitploit: npm install 2 配置 MongoDB 安装 MongoDB...

sift-hardened

sift-hardened Reemplazo directo de sift 17.1.3 que corrige CVE-2026-85625. No está afiliado con crcn/sift.js. Cambios respecto a 17.1.3 Las claves de consulta se enumeran con Object.keys solo propiedades propias, por lo que un Object.prototype.$where contaminado no se trata como un operador. Los...

CVE-2020-1337-exploit

CVE-2020-1337 Windows 权限提升 这是一个 WWW（写-什么-哪里）漏洞利用 致谢 Junyu Zhou（@md5salt），他告诉我可能存在一个新漏洞。 Wenxu Wu（@ma7h1as），我发现了该漏洞并编写了这个利用程序。 工作原理 在 CVE-2020-1048 的补丁中，微软在 XcvData 函数中增加了对 portname 的验证代码。 该验证可通过在 PowerShell 中调用 Add-Printer 来触发。 现在，AddPort 和 XcvData 函数都会检查当前用户是否有权访问 portname。 但我们仍然可以使用 junction...

BIT-GRAFANA-2026-19475 SQL Data Source Plugin: OOM DoS via $__timeGroup macro

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can...

CVE-2024-53900

es-define-property Object.defineProperty, but not IE 8's broken one...

CVE-2026-43499-ZFOLD4

CVE-2026-43499-ZFOLD4 CVE-2026-43499（IonStack PI write-what-where）的设备专项研究移植， 适用于加拿大版 Galaxy Z Fold4 SM-F936W ，固件版本 F936WVLU1AVGA 。 本仓库是 CVE-2026-43499-S24U 和 CVE-2026-43499-A36 的 Fold4 对应版本。它 记录了当前未完成 的进展：回收、残留栈 UAF 布防、 以及 leftover.lock 覆盖均已就位；7 的 lock.waiters 插入 从未落到被回收的页面上。CFI / physrw / root 尚...

CVE-2026-85625

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

CVE-2026-85625

sift (sift.js) 17.1.3 is vulnerable to remote code execution due to its use of for...in to enumerate query keys, which walks the object prototype chain and dispatches any matched operator key including $where . The $where operator compiles a string value into a function via new Function unless CS...

CVE-2026-85625 sift 17.1.3 Prototype Pollution Remote Code Execution via $where

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

EUVD-2026-71232

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

PT-2026-85549

Name of the Vulnerable Software and Affected Versions sift sift.js versions prior to 17.1.4 Description The software enumerates query keys using a for...in loop, which traverses the object prototype chain and dispatches matched operator keys, including $where. The $where operation compiles a stri...

CVE-2026-19475

Grafana is vulnerable to a denial of service via a bypass of the fix for CVE-2026-33375 . An authenticated user with permission to query a SQL data source can inject the timeGroup macro through a WHERE clause , which Grafana's regex-based macro parsing does not reject. Evaluating the injected mac...

CVE-2026-82744 Ash.Reactor change step fails open, skipping a change when its where guard raises

Not Failing Securely Failing Open vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep...

CVE-2026-82744

ash-project ash (Elixir library) contains a Failing Open vulnerability in Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex). When a where guard controlling a change step raises an exception (e.g., on attacker-influenced input), the rescue in apply_validation converts it to {:error, er...

CVE-2026-82744 Ash.Reactor change step fails open, skipping a change when its where guard raises

Not Failing Securely Failing Open vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep...

CVE-2026-81579

In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey264.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrato...

EUVD-2026-66984

In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey264.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrato...

CVE-2026-81579 An untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows

In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey264.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrato...

CVE-2026-81579

WibuKey for Windows (versions before 6.71 ) is affected by an untrusted pointer dereference in the WibuKey2_64.sys kernel driver (64-bit Windows), which exposes a write-what-where primitive. This enables a local unprivileged user to escalate privileges, potentially executing arbitrary code, spawn...