libxslt xsltEvalXPathStringNs Use-After-Free

There is a use-after-free issue in libxslt that could be used to leak information and potentially execute arbitrary code...

Gibbon 25.0.0 Local File Inclusion

Gibbon version 25.0.0 local file inclusion exploit that downloads a SQL dump...

Akira Ransomware Bruteforcer

This tool helps decrypt encrypted files from Akira Ransomware Linux/ESXI variant 2024 using a bunch of GPUs...

TP-Link TL-WR845N Hardcoded Credentials

Proof of concept exploit that checks if your TP-Link TL-WR845N router suffers from a hardcoded credential vulnerability...

Creating Scripts to Identify Vulnerable HTTP Webservers

This whitepaper covers how to create Nmap scripts to identify banners and versions of webservers. It also covers methods to mitigate the public visibility of banners and version information on webservers. Written in Portuguese...

Creating Scripts to Identify Vulnerable Proxy Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of proxy servers. It also covers methods to mitigate the public visibility of banners and version information on proxy servers. Written in Portuguese...

Linux 6.4 VMA Use-After-Free / Race Condition

Linux 6.4 suffers from a use-after-free condition when per-VMA locks introduce a race between page fault and MREMAPDONTUNMAP...

PowerVR DEVMEMXINT_RESERVATION::ppsPMR Lock Failure

The array ppsPMR in DEVMEMXINTRESERVATION holds references to PMR structures using PMRRefPMR2, intending to prevent the PMRs' physical memory from being released. However, PMRs with PVRSRVMEMALLOCFLAGNOOSPAGESONALLOC which for OSMem PMRs internally translates to FLAGONDEMAND can release their...

Creating Scripts to Identify Vulnerable Oracle Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of Oracle servers. It also covers methods to mitigate the public visibility of banners and version information on Oracle servers. Written in Portuguese...

Linux 4.10 __do_semtimedop() Use-After-Free

Linux versions from 4.10 suffers from a use-after-free condition in dosemtimedop due to a lockless check outside RCU section...

Linux FUSE Use-After-Free

FUSE in Linux allows use-after reads of write buffers, allowing theft of partial /etc/shadow hashes...

adsprpc Refcount Leak / Use-After-Free

adsprpc suffers from a refcount leak that leads to a use-after-free condition in fastrpcgetprocessgids...

Linux ax88179_rx_fixup() Out-Of-Bounds Access

drivers/net/usb/ax88179178a.c contains multiple out-of-bounds accesses in ax88179rxfixup, the function responsible for taking a buffer received over USB and splitting it up into ethernet packets...

Linux LSM POSIX Lock Use-After-Free

An LSM can prevent the fcntl/close race cleanup path in fcntlsetlk from working, leading to use-after-free read in lockgetstatus when reading /proc/locks...

Linux DCCP Binary Information Leak

Linux suffers from a small remote binary information leak in DCCP that requires a victim's machine to have established connections...

Creating Scripts to Identify Vulnerable POP Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of POP servers. It also covers methods to mitigate the public visibility of banners and version information on POP servers. Written in Portuguese...

Creating Scripts to Identify Vulnerable Telnet Services

This whitepaper covers how to create Nmap scripts to identify banners and versions of Telnet servers. It also covers methods to mitigate the public visibility of banners and version information on Telnet servers. Written in Portuguese...

PowerVR DevmemIntChangeSparse2() Use-After-Free

PowerVR suffers from a DevmemIntChangeSparse2 use-after-free condition on a PMRGetUID call...

Linux 4.20 ktls Write Issue

When splice is called with a ktls socket as destination, the ktls code fails to update the internal "curr"/"copybreak" accounting that tracks which parts of the plaintext scatter-gather buffer struct skmsgsg are unused writable memory. This can cause subsequent writes to the socket to overwrite t...

Linux 3.19 anon_vma Use-After-Free

Linux 3.19 suffers from a use-after-free vulnerability via anonvma...

Linux 6.5 Kernel Pointer Leak

The Linux cachestat syscall introduced in 6.5 has a read-after-type-change of folio that leads to a kernel pointer leak...

Linux Stale TLB Use-After-Free

Linux stable versions 5.4 and 5.10 suffer from a page use-after-free condition via a stale TLB entry caused by rmap lock not being held during PUD move...

Apache Tomcat Remote Code Execution

Apache Tomcat proof of concept remote code execution exploit that affects versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, and 9.0.0.M1 through 9.0.98...

Linux FUSE Uninitialized Memory Read

FUSE on Linux has an issue where a page is marked uptodate while actually containing uninitialized data beyond EOF, so uninitialized memory can be read via mmap on systems without init-on-alloc...

Linux munmap() Race Condition / Use-After-Free

Linux munmap has a race condition with pagemapread that leads to a page use-after-free condition...

Creating Scripts to Identify Vulnerable SMTP Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of SMTP servers. It also covers methods to mitigate the public visibility of banners and version information on SMTP servers. Written in Portuguese...

Penetration Testing Steps and Tools

This whitepaper goes over reconnaissance of a target, various types of attacks leveraged during penetration testing, and provides examples of the commands used in the process...

WordPress Elementor Pro Animation Addon 1.6 Missing Authorization

The Animation Addons for Elementor Pro plugin versions 1.6 and below on WordPress suffers from a missing capability check allowing for arbitrary plugin installation...

WordPress Finale Lite 2.18.0 Missing Authorization

WordPress Finale Lite plugin versions 2.18.0 and below missing authorization proof of concept exploit that allows an attacker to install and activate arbitrary plugins...

WordPress Th Shop Mania Theme 1.4.9 Missing Authorization

WordPress Th Shop Mania theme versions 1.4.9 and below missing capability check proof of concept exploit allowing for arbitrary plugin installation...

WordPress NextMove Lite 2.17.0 Missing Authorization

WordPress NextMove Lite plugin version 2.17.0 missing authorization proof of concept exploit that allows an attacker to install and activate arbitrary plugins...

Creating Scripts to Identify Vulnerable SSH Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of SSH servers. It also covers methods to mitigate the public visibility of banners and version information on SSH servers. Written in Portuguese...

Pexels Free Stock Photos 1.2.2 Shell Upload

Pexels Free Stock Photos versions 1.2.2 and below suffer from a remote shell upload vulnerability...

WordPress WooCommerce 2.4.1 Arbitrary File Upload

This exploit leverages an unauthorized limited arbitrary file upload vulnerability in the Order Attachments for WooCommerce plugin versions 2.0 to 2.4.1 for WordPress. The vulnerability allows authenticated users Subscriber+ to upload restricted file types without proper authorization...

WordPress ThemeEgg ToolKit 1.2.9 Shell Upload

WordPress ThemeEgg ToolKit plugin versions 1.2.9 and below suffer from a remote shell upload vulnerability...

WordPress Top Store Theme 1.5.4 Privilege Escalation

This script exploits CVE-2024-10673, a critical vulnerability found in the Top Store WordPress Theme versions 1.5.4 and below. The flaw allows authenticated users with subscriber-level access or higher to install and activate arbitrary plugins via unprotected AJAX requests. This can lead to...

Creating Scripts to Identify Vulnerable FTPs

This whitepaper covers how to create Nmap scripts to identify banners and versions of FTP servers. It also covers methods to mitigate the public visibility of banners and version information on FTP servers. Written in Portuguese...

WordPress GPX Viewer 2.2.8 Arbitrary File Creation

WordPress GPX Viewer plugin versions 2.2.8 and below suffer from an arbitrary file creation vulnerability...

A Practical Memory Injection Attack against LLM Agents

In this whitepaper, the authors propose a novel Memory INJection Attack, MINJA, that enables the injection of malicious records into the memory bank by only interacting with the agent via queries and output observations...

Creating Scripts to Identify Vulnerable IMAP

This whitepaper covers how to create Nmap scripts to identify banners and versions of IMAP servers. It also covers methods to mitigate the public visibility of banners and version information on IMAP servers. Written in Portuguese...

How to Create a Scan for Server-Side Request Forgery

This whitepaper covers how to create a scan in Perl to identify server-side request forgery in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid SSRF problems at the cod...

How to Create a Scan to Identify Remote Command Execution

This whitepaper covers how to create a scan in Perl to identify remote command execution in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid RCE problems at the code...

How to Create a Scan to Identify Remote File Inclusion

This whitepaper covers how to create a scan in Perl to identify remote file inclusion in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid remote file inclusion problems...

How to Create a Scan to Identify Command Injection

This whitepaper covers how to create a scan in Perl to identify remote code injection in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid remote code injection problems...

cvp Incorrect Bailout Use-After-Free

In the function msmcvpmapbufwncc reachable from the EVAKMDREGISTERBUFFER ioctl, after cbuf is created and fully initialized, it is unconditionally added to the linked list inst-cvpwnccbufs.list. msmcvpmapbufwncc then tries to add an entry for the buffer to inst-cvpwnccbufstable. This can fail if...

Proxyrack Global Cybercrime Report 2025

This report delves into the key trends, statistical insights, and geographical impacts of cybercrime, while exploring attack vectors and the industries and regions most affected...

Firefox txMozillaXSLTProcessor Use-After-Free

There is a use-after-free vulnerability in Firefox in txMozillaXSLTProcessor. The vulnerability was reproduced with an ASAN build from the latest source code...

How to Create a Scan for Open Redirects

This whitepaper covers how to create a scan in Perl to identify open redirection in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid open redirect problems at the code...

How to Create a Scan for Path Traversal

This whitepaper covers how to create a scan in Perl to identify path traversal in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid path traversal problems at the code...

How to Create a Scan for Local File Inclusion

This whitepaper covers how to create a scan in Perl to identify different types of local file inclusion in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid local file...