PS4-6.20-WebKit-Code-Execution-Exploit

PS4 6.20 WebKit Code Execution PoC This repo contains a proof-of-concept PoC RCE exploit targeting the PlayStation 4 on firmware 6.20 leveraging CVE-2018-4441. The exploit first establishes an arbitrary read/write primitive as well as an arbitrary object address leak in wkexploit.js. It will then...

BlueGate

BlueGate Proof of Concept Denial of Service + scanner for CVE-2020-0609 and CVE-2020-0610. These vulnerabilities allows an unauthenticated attacker to gain remote code execution with highest privileges via RD Gateway for RDP. Please use for research and educational purpose only. Usage Make sure y...

CVE-2022-22706-poc

CVE-2022-22706 - ページキャッシュ書き込み Arm Mali GPU ドライバーは、読み取り専用としてピン留めしたページのCPU書き込み可能なマッピングをユーザースペースに渡します。そのため、非特権プロセスは、ORDONLY でしか開けないファイルをバックするページキャッシュの書き込み可能なエイリアスを取得します。 exploit.c は、/etc/passwd ページキャッシュ内のrootのパスワードフィールドを空にして、su root を実行します。ディスク上のファイルは変更されません。...

CVE-2026-36848

CVE-2026-36848 A critical path traversal vulnerability was identified in the web-based management engine on port 8089 of Gigamon-VUE OS GVOS appliances. This flaw exists in the legacy H-VUE subsystem within the persistd daemon and allows an unauthenticated, remote attacker with network access to...

CVE-2024-2887

CVE-2024-2887 This is a short writeup for the CVE-2024-2887, which I used to claim V8CTF M123. When define more types than kV8MaxWasmTypes, which can be achieved by padding more types in RecGroup, the types index can be more than 20bits and then overflowed. Then two types can be considered same a...

CVE-2026-46331

🚨 CVE-2026-46331 - Linux Kernel COW Bug Linux Kernel net/sched Partial Copy-on-Write COW Page Cache Corruption -orange?style=for-the-badge A Linux kernel vulnerability caused by incorrect Copy-on-Write COW handling in the traffic control tc packet editing subsystem. 📖 Overview CVE-2026-46331 is a...

CVE-2024-25641

CVE-2024-25641 RCE for Cacti 1.2.26 This repository automates the process of exploiting CVE-2024-25641 on Cacti 1.2.26. When a user is authenticated, An arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates"...

CVE-2023-45878

CVE-2023-45878 Wrote this script based on the work of https://herolab.usd.de/security-advisories/usd-2023-0025/ . The exploit works by using an Arbitrary File Write exploit in Gibbon LMS 25.0.1 . This PoC will use upload a simple php cmd script, and then use that to load a powershell revshell...

CVE-2023-52076-PoC

CVE-2023-52076-PoC CVE-2023-52076 の概念実証（Proof-of-concept）です。これは、MATE Desktop 環境に影響する Atril/Xreader ドキュメントビューアにおける、重大なパストラバーサルおよび任意ファイル書き込みの脆弱性です。 このスクリプトは、SSH 設定または自動起動（autostart）デスクトップエントリのいずれかを標的とした zip-slip パスを含む細工済み EPUB ペイロードを生成し、標的システム上でのリモートコマンド実行を可能にします。 機能 1. SSH キーインジェクションと autostart RC...

CVE-2024-21633

MobSF Remote code execution via CVE-2024-21633 I have found an arbitrary file write in apktool and reported via github security advisory. I was aware that many projects were relied upon or dependent to apktool but after the publish of advisory and fix not many seem to be noticed or cared about it...

CVE-2022-0185

CVE-2022-0185 This repo contains demo exploits for CVE-2022-0185. There are two versions here. The non-kctf version fuse version specifically targets Ubuntu with kernel version 5.11.0-44. It does not directly return a root shell, but makes /bin/bash suid, which will lead to trivial privilege...

Exploit for CVE-2026-105314

Papermerge-core: Authenticated Path Traversal to Arbitrary Fil...

pois0nSword

pois0nSword In development, not currently useful for users. pois0nSword is an iOS project with the goal of eventually enabling user interface customization. Currently a demonstration of arbitrary webcontent read write using cve-2025-43529 on iOS 26.1. As well as a PAC bypass utilizing...

cve-2014-0038

Local root exploit for CVE-2014-0038 Bug: The X86X32 recvmmsg syscall does not properly sanitize the timeout pointer passed from userspace. Exploit primitive: Pass a pointer to a kernel address as timeout for recvmmsg, if the original byte at that address is known it can be overwritten with known...

CVE-2022-0995

CVE-2022-0995 This is my exploit for CVE-2022-0995, an heap out-of-bounds write in the watchqueue Linux kernel component. It uses the same technique described in https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html. The exploit targets Ubuntu 21.10 with kernel...

cve-2016-0040

cve-2016-0040 poc for cve-2016-0040 bug found and exploited by Meysam Firozi @R00tkitSmm this poc help write arbitrary data to arbitrary address in windows kernel for more info see ny blog : http://ioctl.ir/index.php/2016/02/13/cve-2016-0040-story-of-uninitialized-pointer/...

CVE-2021-22555-Exploit

CVE-2021-22555-Exploit CVE-2021-22555 Exploit By Andy Nguyen INFO A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This allows an attacker to gain privileges or cause a DoS via heap memory corruption through user name space 編譯 gcc -m32 -stati...

Exploit for Out-of-bounds Write in Apple Ipados

🛡️ CVE-2026-86950 — CoreGraphics Security Research...

kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When processing Internet Control Message Protocol ICMP errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet,...

DEBIAN-CVE-2026-63266

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or...