PT-2026-128212

Name of the Vulnerable Software and Affected Versions Eclipse Che che-machine-exec affected versions not specified Description The che-machine-exec service is subject to OS command injection. The service constructs shell commands by concatenating user-controlled input into a double-quoted sh -c...

PT-2026-129201

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell...

PT-2026-129195

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted...

ESPHome Device Builder Dashboard configuration error vulnerability

Versions of ESPHome Device Builder Dashboard prior to 1.0.10 contain a configuration error vulnerability. This vulnerability arises because the trusted ingress site associated with the Home Assistant plugin is bound to 0.0.0.0, and dashboard authentication is bypassed. Additionally, the host...

Joern 4.0.667

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

NUUO Crystal Server 3.19.0.85 Unauthenticated Shell Upload

NUUO Crystal Server version 3.19.0.85 contains an unauthenticated upload.php endpoint that accepts a client-controlled filename and file content, allowing a PHP file to be written into the web root and executed through the server's PHP mapping. A proof of concept is included...

CVE-2026-57203

The Asterisk telephony toolkit is vulnerable to local privilege escalation due to a CWE-426 untrusted search path issue. In versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 , and Certified Asterisk 20.7-cert11, 22.8-cert3 , the ast_loggrabber component executes a Python script from the world-w...

CVE-2019-16759

CVE-2019-16759 vBulletin 5.x Unauthorized RCE Batch Detection Script This vulnerability is quite trivial; out of 200+ random targets, only 5 had it. Now handle it yourself—you already have PHP, how can you not get a reverse shell?...

EUVD-2026-111231

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

CVE-2026-117573

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagentarduino and hagentesp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated...

CVE-2026-117569

Kali-GPT through commit a608c74 contains an OS command injection vulnerability in executetool in kaligpt/tools/mcpserver.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target,...

CVE-2026-117560

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $ or backtick substitutions into parameters...

CVE-2026-117559

DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $... or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.runshell or...

Maian Guardian license generator command injection RCE

Admin ajax-ops=generate — shell expansion in projid writes marker under content/ and runs attacker command. """Maian Guardian license generator command injection RCE.""" from future import annotations import re import uuid from urllib.parse import urlencode from kittysploit import from...

StreamSets default credentials Shell executor RCE

Basic-auth REST API creates a pipeline with Dev Raw Source + ShellDExecutor, starts it, and runs attacker shell script as the SDC user sudo -n when root mode. !/usr/bin/env python3 -- coding: utf-8 -- """StreamSets Data Collector default creds + Shell executor pipeline RCE.""" from future import...

Puppet Enterprise — CVE-2025-5459 Patch-Bypass Variant → keytool Shell Injection — Detect

Fingerprint / reachability check for Puppet Enterprise — CVE-2025-5459 Patch-Bypass Variant → keytool Shell Injection → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Puppet Enterprise — CVE-2025-5459 Patch-Bypass Variant → keytool Shell Injection → Root RCE""" from kittysplo...

StreamSets DataCollector — Default Credentials + Shell Executor → Root RCE — Detect

Fingerprint / reachability check for StreamSets DataCollector — Default Credentials + Shell Executor → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for StreamSets DataCollector — Default Credentials + Shell Executor → Root RCE""" from kittysploit import from...

core-admin escape_param shell injection (bytecode sink)

Loads product security.pyc/command.pyc to craft shell metacharacters for configured sink templates local bytecode lab; use product UI/API on target. """core-admin — Systemic Shell Command Injection via Ineffective Quote Escaping → Authenticated Root RCE""" from future import annotations from...

Puppet Enterprise keytool shell injection root RCE

RBAC token → classifier PE Master group → javakeystorepasswd injection + trustedinfracacert trigger; orchestrator deploy runs agent. """Puppet Enterprise classifier keytool passwd injection CVE-2025-5459 variant.""" from future import annotations import json import re from kittysploit import from...

CVE-2026-117573 hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagentarduino and hagentesp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated...