Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
3 vulnerabilities by Public
GCVE-1988-2026-0196
Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 10:10
VLAI
EPSS
VEX
Title
🚨 Public Disclosure: Remote BitLocker Bypass via Intel AMT — SYSTEM Access Without Login
Summary
🔓 The Attack Path — No Login, SYSTEM Access
1. Boot into setup.exe (via USB, PXE, or OOBM like Intel vPro).
2. Click “Repair your computer” → Enter WinRE.
3. Press Shift + F10 → SYSTEM-level Command Prompt.
4. From there, attacker can:
- Run `net user` to create new admin accounts
- Use `diskpart` to wipe or reformat drives
- Use `manage-bde -off` or `bcdedit` to disable BitLocker
- Replace `utilman.exe` to bypass login
- Implant persistence or backdoors
🧠 Why BitLocker Doesn’t Save You
- BitLocker is inactive in Setup or WinRE — the OS hasn’t loaded, and the
BitLocker driver isn’t running.
- If BitLocker is TPM-only (no PIN/USB), the drive is already unlocked at
boot.
- TPM 2.0 *can* block key release — but only if:
- Secure Boot is enforced
- PCR bindings are tightly configured
- Boot order is locked
- USB/PXE boot is disabled
- OOBM is secured
Most orgs don’t meet all those conditions. Even if BitLocker triggers
recovery, an attacker can still wipe the drive or implant malware.
CVE-2025-26637 and tools like BitUnlocker show how these vectors are
being actively explored.
🧨 “But We Have Immutable Backups”
That protects data availability — not system integrity.
If I implant malware or create a hidden admin account, you’ll restore into
a compromised environment. Immutable backups don’t detect or prevent:
- Credential theft
- Persistence
- Backdoored reboots
- Silent compromise of trust
🌐 Remote Risk: OOBM
With Intel vPro, I can:
- Mount virtual media
- Boot into Setup or WinRE
- Execute all of the above remotely, without touching the device
Intel’s own docs highlight how vPro enables remote boot and media mounting
— a dream for IT, and a gift for attackers if misconfigured.
🧱 This Isn’t About “Wasting Access”
It’s about how Microsoft’s own tooling enables unauthenticated SYSTEM
access in environments that are supposed to be secure.
If your only defense is “well, that’s by design,” then the design *is* the
vulnerability.
🔒 BIOS/UEFI Passwords: A Broken Mitigation
Microsoft may argue that setting a BIOS/UEFI password mitigates this
attack. But in practice, this “defense” is deeply flawed:
- **No visual feedback**: Users can’t see what they’re typing — no
asterisks, no characters, nothing.
- **No Caps Lock indicator**: If Caps Lock is on, users won’t know — and
their input silently fails.
- **No support for special characters**: Most firmware restricts input to
basic alphanumeric characters.
- **Short password limits**: Many systems cap passwords at 8–16 characters.
- **No brute-force protection**: Some BIOS/UEFI setups don’t lock out after
failed attempts.
The result? Users get scared, fumble their input, and retreat to normal
boot — where the system is already unlocked and vulnerable. The illusion of
security becomes the attack vector.
If this is the only mitigation, then the system is fundamentally broken.
— Darsh
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-description |
| https://seclists.org/fulldisclosure/2026/Feb/15 | technical-description |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Public | 🚨 Public Disclosure |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0196 (this record)
- related CVE-2025-26637
{
"containers": {
"cna": {
"affected": [
{
"product": "\ud83d\udea8 Public Disclosure",
"vendor": "Public",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Darsh Naik"
}
],
"descriptions": [
{
"lang": "en",
"value": "\ud83d\udd13 The Attack Path \u2014 No Login, SYSTEM Access\n\n1. Boot into setup.exe (via USB, PXE, or OOBM like Intel vPro).\n2. Click \u201cRepair your computer\u201d \u2192 Enter WinRE.\n3. Press Shift + F10 \u2192 SYSTEM-level Command Prompt.\n4. From there, attacker can:\n - Run `net user` to create new admin accounts\n - Use `diskpart` to wipe or reformat drives\n - Use `manage-bde -off` or `bcdedit` to disable BitLocker\n - Replace `utilman.exe` to bypass login\n - Implant persistence or backdoors\n\n\ud83e\udde0 Why BitLocker Doesn\u2019t Save You\n\n- BitLocker is inactive in Setup or WinRE \u2014 the OS hasn\u2019t loaded, and the\nBitLocker driver isn\u2019t running.\n- If BitLocker is TPM-only (no PIN/USB), the drive is already unlocked at\nboot.\n- TPM 2.0 *can* block key release \u2014 but only if:\n - Secure Boot is enforced\n - PCR bindings are tightly configured\n - Boot order is locked\n - USB/PXE boot is disabled\n - OOBM is secured\n\nMost orgs don\u2019t meet all those conditions. Even if BitLocker triggers\nrecovery, an attacker can still wipe the drive or implant malware.\n\nCVE-2025-26637 and tools like BitUnlocker show how these vectors are\nbeing actively explored.\n\n\ud83e\udde8 \u201cBut We Have Immutable Backups\u201d\n\nThat protects data availability \u2014 not system integrity.\n\nIf I implant malware or create a hidden admin account, you\u2019ll restore into\na compromised environment. Immutable backups don\u2019t detect or prevent:\n- Credential theft\n- Persistence\n- Backdoored reboots\n- Silent compromise of trust\n\n\ud83c\udf10 Remote Risk: OOBM\n\nWith Intel vPro, I can:\n- Mount virtual media\n- Boot into Setup or WinRE\n- Execute all of the above remotely, without touching the device\n\nIntel\u2019s own docs highlight how vPro enables remote boot and media mounting\n\u2014 a dream for IT, and a gift for attackers if misconfigured.\n\n\ud83e\uddf1 This Isn\u2019t About \u201cWasting Access\u201d\n\nIt\u2019s about how Microsoft\u2019s own tooling enables unauthenticated SYSTEM\naccess in environments that are supposed to be secure.\n\nIf your only defense is \u201cwell, that\u2019s by design,\u201d then the design *is* the\nvulnerability.\n\n\ud83d\udd12 BIOS/UEFI Passwords: A Broken Mitigation\n\nMicrosoft may argue that setting a BIOS/UEFI password mitigates this\nattack. But in practice, this \u201cdefense\u201d is deeply flawed:\n\n- **No visual feedback**: Users can\u2019t see what they\u2019re typing \u2014 no\nasterisks, no characters, nothing.\n- **No Caps Lock indicator**: If Caps Lock is on, users won\u2019t know \u2014 and\ntheir input silently fails.\n- **No support for special characters**: Most firmware restricts input to\nbasic alphanumeric characters.\n- **Short password limits**: Many systems cap passwords at 8\u201316 characters.\n- **No brute-force protection**: Some BIOS/UEFI setups don\u2019t lock out after\nfailed attempts.\n\nThe result? Users get scared, fumble their input, and retreat to normal\nboot \u2014 where the system is already unlocked and vulnerable. The illusion of\nsecurity becomes the attack vector.\n\nIf this is the only mitigation, then the system is fundamentally broken.\n\n\u2014 Darsh\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:10:03Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/15"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Feb/15"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Feb/15"
],
"discovery": "EXTERNAL"
},
"title": "\ud83d\udea8 Public Disclosure: Remote BitLocker Bypass via Intel AMT \u2014 SYSTEM Access Without Login",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2025-26637",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0196",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/15",
"automated": true,
"contentSha256": "f040d4b4fe72eaa256389d7d98535d9e6a80d6854206acaf9f0d0980779cb650",
"evidenceScore": 6,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/15",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-02-15T04:56:38Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0196"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:41Z",
"dateUpdated": "2026-09-09T10:10:03Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0196"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-11175 (GCVE-0-2024-11175)
Vulnerability from nvd – Published: 2024-11-13 15:31 – Updated: 2024-11-13 18:27
VLAI
EPSS
VEX
Title
Public CMS Voting Management save cross site scripting
Summary
A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of the component Voting Management. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named b9530b9cc1f5cfdad4b637874f59029a6283a65c. It is recommended to apply a patch to fix this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-13 18:25 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.284351 | vdb-entry |
| https://vuldb.com/?ctiid.284351 | signaturepermissions-required |
| https://gitee.com/sanluan/PublicCMS/issues/IB2BUV | exploitissue-tracking |
| https://gitee.com/sanluan/PublicCMS/commit/b9530b… | broken-linkpatch |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:publiccms:publiccms:5.202406.d:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "publiccms",
"vendor": "publiccms",
"versions": [
{
"status": "affected",
"version": "5.202406.d"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11175",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-13T18:25:45.141558Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-13T18:27:34.447Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Voting Management"
],
"product": "CMS",
"vendor": "Public",
"versions": [
{
"status": "affected",
"version": "5.202406.d"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB Gitee Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of the component Voting Management. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named b9530b9cc1f5cfdad4b637874f59029a6283a65c. It is recommended to apply a patch to fix this issue."
},
{
"lang": "de",
"value": "Eine problematische Schwachstelle wurde in Public CMS 5.202406.d gefunden. Es geht hierbei um eine nicht n\u00e4her spezifizierte Funktion der Datei /admin/cmsVote/save der Komponente Voting Management. Dank Manipulation mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Der Patch wird als b9530b9cc1f5cfdad4b637874f59029a6283a65c bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-13T15:31:26.613Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-284351 | Public CMS Voting Management save cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.284351"
},
{
"name": "VDB-284351 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.284351"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://gitee.com/sanluan/PublicCMS/issues/IB2BUV"
},
{
"tags": [
"broken-link",
"patch"
],
"url": "https://gitee.com/sanluan/PublicCMS/commit/b9530b9cc1f5cfdad4b637874f59029a6283a65c"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-11-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-11-13T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-11-13T10:22:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "Public CMS Voting Management save cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-11175",
"datePublished": "2024-11-13T15:31:26.613Z",
"dateReserved": "2024-11-13T09:17:31.631Z",
"dateUpdated": "2024-11-13T18:27:34.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11175 (GCVE-0-2024-11175)
Vulnerability from cvelistv5 – Published: 2024-11-13 15:31 – Updated: 2024-11-13 18:27
VLAI
EPSS
VEX
Title
Public CMS Voting Management save cross site scripting
Summary
A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of the component Voting Management. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named b9530b9cc1f5cfdad4b637874f59029a6283a65c. It is recommended to apply a patch to fix this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-13 18:25 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.284351 | vdb-entry |
| https://vuldb.com/?ctiid.284351 | signaturepermissions-required |
| https://gitee.com/sanluan/PublicCMS/issues/IB2BUV | exploitissue-tracking |
| https://gitee.com/sanluan/PublicCMS/commit/b9530b… | broken-linkpatch |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:publiccms:publiccms:5.202406.d:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "publiccms",
"vendor": "publiccms",
"versions": [
{
"status": "affected",
"version": "5.202406.d"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11175",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-13T18:25:45.141558Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-13T18:27:34.447Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Voting Management"
],
"product": "CMS",
"vendor": "Public",
"versions": [
{
"status": "affected",
"version": "5.202406.d"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB Gitee Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of the component Voting Management. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named b9530b9cc1f5cfdad4b637874f59029a6283a65c. It is recommended to apply a patch to fix this issue."
},
{
"lang": "de",
"value": "Eine problematische Schwachstelle wurde in Public CMS 5.202406.d gefunden. Es geht hierbei um eine nicht n\u00e4her spezifizierte Funktion der Datei /admin/cmsVote/save der Komponente Voting Management. Dank Manipulation mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Der Patch wird als b9530b9cc1f5cfdad4b637874f59029a6283a65c bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-13T15:31:26.613Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-284351 | Public CMS Voting Management save cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.284351"
},
{
"name": "VDB-284351 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.284351"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://gitee.com/sanluan/PublicCMS/issues/IB2BUV"
},
{
"tags": [
"broken-link",
"patch"
],
"url": "https://gitee.com/sanluan/PublicCMS/commit/b9530b9cc1f5cfdad4b637874f59029a6283a65c"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-11-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-11-13T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-11-13T10:22:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "Public CMS Voting Management save cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-11175",
"datePublished": "2024-11-13T15:31:26.613Z",
"dateReserved": "2024-11-13T09:17:31.631Z",
"dateUpdated": "2024-11-13T18:27:34.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}