CVE-2025-32463.zip
1.3 KB
CVE-2025-32463
Author: dr4xp
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
GitHub Link:
https://github.com/dr4xp/sudo-chroot
Author: dr4xp
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
GitHub Link:
https://github.com/dr4xp/sudo-chroot
CVE-2024-27956.zip
3.6 KB
CVE-2024-27956
Author: 0axz-tools
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.
GitHub Link:
https://github.com/0axz-tools/CVE-2024-27956
Author: 0axz-tools
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.
GitHub Link:
https://github.com/0axz-tools/CVE-2024-27956
CVE-2025-32463.zip
1.3 KB
CVE-2025-32463
Author: dr4x-c0d3r
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
GitHub Link:
https://github.com/dr4x-c0d3r/sudo-chroot
Author: dr4x-c0d3r
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
GitHub Link:
https://github.com/dr4x-c0d3r/sudo-chroot
CVE-2015-1328.zip
3.7 KB
CVE-2015-1328
Author: thieveshkar
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
GitHub Link:
https://github.com/thieveshkar/RootQuest-CTF-Box-Multi-Stage-Exploitation-VM
Author: thieveshkar
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
GitHub Link:
https://github.com/thieveshkar/RootQuest-CTF-Box-Multi-Stage-Exploitation-VM
CVE-2020-1472.zip
5.4 KB
CVE-2020-1472
Author: nyambiblaise
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'.
GitHub Link:
https://github.com/nyambiblaise/Domain-Controller-DC-Exploitation-with-Metasploit-Impacket
Author: nyambiblaise
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'.
GitHub Link:
https://github.com/nyambiblaise/Domain-Controller-DC-Exploitation-with-Metasploit-Impacket
CVE-2021-27905.zip
3.7 MB
CVE-2021-27905
Author: RIZZZIOM
The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.
GitHub Link:
https://github.com/RIZZZIOM/CVE-2021-27905
Author: RIZZZIOM
The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.
GitHub Link:
https://github.com/RIZZZIOM/CVE-2021-27905
CVE-2025-33073.zip
10.8 KB
CVE-2025-33073
Author: SellMeFish
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
GitHub Link:
https://github.com/SellMeFish/windows-smb-vulnerability-framework-cve-2025-33073
Author: SellMeFish
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
GitHub Link:
https://github.com/SellMeFish/windows-smb-vulnerability-framework-cve-2025-33073
CVE-2022-30190.zip
2.6 KB
CVE-2022-30190
Author: Arkha-Corvus
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.
GitHub Link:
https://github.com/Arkha-Corvus/LetsDefend-SOC173-Follina-0-Day-Detected
Author: Arkha-Corvus
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.
GitHub Link:
https://github.com/Arkha-Corvus/LetsDefend-SOC173-Follina-0-Day-Detected
CVE-2025-27591.zip
1.2 KB
CVE-2025-27591
Author: krn966
A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
GitHub Link:
https://github.com/krn966/CVE-2025-27591
Author: krn966
A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
GitHub Link:
https://github.com/krn966/CVE-2025-27591
CVE-2025-32433.zip
2.5 KB
CVE-2025-32433
Author: Batman529
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
GitHub Link:
https://github.com/Batman529/PoC-CVE-2025-32433
Author: Batman529
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
GitHub Link:
https://github.com/Batman529/PoC-CVE-2025-32433
CVE-2022-22965.zip
6.5 KB
CVE-2022-22965
Author: NickoPS87
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
GitHub Link:
https://github.com/NickoPS87/Spring4Shell-Python-Firewall-POC
Author: NickoPS87
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
GitHub Link:
https://github.com/NickoPS87/Spring4Shell-Python-Firewall-POC