CVE-2023-21768-POC

CVE-2023-21768-POC CVE-2023-21768 Windows 11 22H2 Local Privilege Escalation POC Usage: WindowsAFDLPECVE-2023-21768.exe Where is the process ID decimal to elevate, causing the target process to be elevated to SYSTEM privileges...

CVE-2023-21768

CVE-2023-21768 Local Privilege Escalation POC authors: chompie & b33f For demonstration purposes only. Complete exploit works on vulnerable Windows 11 22H2 systems. Write primitive works on all vulnerable systems. Usage: WindowsAFDLPECVE-2023-21768.exe where is the process ID in decimal of the...

CVE-2025-5548

🛡️ Analysis and Exploitation: CVE-2025-5548 Master in Cybersecurity | Module 6: Vulnerabilities 👋 Hello! Welcome to my Analysis Workshop In this repository I document my practical immersion in binary-level vulnerability analysis and the development of exploits for Windows environments. The main...

Exploit for Heap-based Buffer Overflow in Microsoft

the bug is at DnsQueryRaw function to be specific, inside DnsRa...

RoguePlanet

RoguePlanet RoguePlanet Windows Defender Vulnerability Welcome back everyone !!! The exploit is a race condition, so it's a hit or miss. I have managed to get a 100% success rate on some machines while it struggled to work on others. The exploit has been tested in Windows 11 Official channel +...

CVE-2026-77605

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd...

CVE-2026-77605 Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd...

CVE-2026-77605

The open-source source code editor Notepad++ contains a vulnerability where the Folder as Workspace Run by system action can resolve a different sibling file than the one selected by the user. On Windows 10 or Windows 11 , an attacker can place a command script (e.g., adding a .cmd extension to t...

CVE-2026-77605 Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd...

EUVD-2026-84573

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd...

CVE-2026-77605 Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd...

CVE-2026-77605: Improper Input Validation

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd...

NotepadPlusPlus: CVE-2026-77605: Improper Input Validation

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd...

PT-2026-96842

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.8 Description The Folder as Workspace Run by system action can resolve a sibling file different from the one selected by the user. On Windows 10 or Windows 11, if an attacker places a command script with the sam...

ShieldBreak

ShieldBreak - Windows Defender 0day 脆弱性 Microsoft は RoguePlanet 脆弱性 CVE-2026-50656 の適切なパッチ適用に失敗しており、この PoC は完全なパッチバイパスを実証しています。 この PoC は、最新バージョンの Windows 11 25H2 +Canary チャネル と Windows Server 2025 でテストされており、成功率は 100% です。 なお、Windows 10 および対応するサーバーエディション は現在サポートされていませんが、ShieldBreak...

HardBreacher

HardBreacher Kaspersky Antivirus For Endpoint のゼロデイ権限昇格の脆弱性 この問題は今やMicrosoftの外にも漏れ出しています。ホーム版か商用版のどちらかにバグを見つけるかという投票が行われ、投票結果は商用版となりました。 これを書いている時点で、この概念実証は完全にパッチが適用されたWindows 11 25H2とKaspersky for Endpoint v14.0.0.504で動作します。...

KLA91279 PE vulnerability in Microsoft Windows

Privilege escalation vulnerability was found in Microsoft Windows. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-85921 Exploitation Related products Microsoft-Windows Microsoft-Windows-11 CVE list CVE-2026-85921 critical KB list 5129194 Solution...

KB5122880: Windows 11 version 23H2 Security Update (September 2026)

The remote Windows host is missing security update 5122880. It is, therefore, affected by multiple vulnerabilities - Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an unauthorized attacker to execute code over a network. CVE-2026-68839 - Integer underflow wrap or...

KB5124008: Windows 11 Version 24H2 / 25H2 / 26H2 Security Update (September 2026)

The remote Windows host is missing security update 5124008. It is, therefore, affected by multiple vulnerabilities - Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an unauthorized attacker to execute code over a network. CVE-2026-68839 - Integer underflow wrap or...

KB5124012: Windows 11 Version 26H1 Security Update (September 2026)

The remote Windows host is missing security update 5124012. It is, therefore, affected by multiple vulnerabilities - Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an unauthorized attacker to execute code over a network. CVE-2026-68839 - Integer underflow wrap or...