tag
Rpc
Windows Message Queuing (MSMQ) Queue Manager Heap-Based Buffer Overflow (CVE-2026-54992)
MSMQ's Queue Manager processes RStartReceive/RStartTransactionalReceive responses from the MS-MQRR RPC interface as a set of SectionBuffer structures, each carrying its own SectionSizeAlloc. When a remote-read response is split into multiple sections,…
SonicWall SMA1000 WorkPlace SSRF → Internal Erlang RPC Remote Code Execution (CVE-2026-15409)
The SMA1000 WorkPlace interface exposes a websocket-based remote-access proxy (wsproxy) that lets an authenticated remote-access session request a proxied connection to a destination host/port/service combination (e.g. SSH, TELNET). The proxy does not…
UpdraftPlus WordPress Plugin — Unauthenticated RPC Key Bypass to Admin Creation & RCE (CVE-2026-10795)
UpdraftPlus ships a remote-management RPC channel (UpdraftCentral) reachable via admin-ajax.php that authenticates requests using an AES-encrypted message keyed to one of several well-known "keyname" identifiers (e.g. migrator.updraftplus.com). When a site…
Samba spoolss Print Job Command Injection RCE (CVE-2026-4480)
This PoC targets a flaw in Samba's spoolss print spooler RPC interface where a submitted print job's document name/content is not safely handled, allowing an attacker who can open a writable printer/share to inject a shell command that gets executed on the…
BlueHammer Defender Local Privilege Escalation (CVE-2026-33825)
BlueHammer is a Windows local privilege-escalation PoC targeting Defender-associated update and scanning behavior. The exploit orchestrates object-manager symbolic links, directory change notifications, oplocks, RPC-triggered Defender activity, and…