CVE-2020-11984

Quick start docker build --no-cache -t cve-2020-11984 . docker run --rm -it -p 8080:80 --name cve-2020-11984 cve-2020-11984 pipenv run python3 exploit.py -u localhost:8080/ -c "echo 111/tmp/abc" Reference https://github.com/RubenBar/MLW-upcrans/...

CVE-2018-9276

CVE-2018-9276 PRTG 18.2.39 Authenticated Command Injection Reverse Shell https://nvd.nist.gov/vuln/detail/CVE-2018-9276 Improved version of an exploit written by https://github.com/M4LV0. I used the POST data from their script but just made it more reliable as I didnt have much success with it...

samsung-bixby-command-execution-cve-2026-21055-improper-component-export

CVE-2026-21055 PoC — Samsung Bixby Improper Component Export Proof of Concept for CVE-2026-21055 : Improper export of Android application components in Samsung Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege. Overview This repository...

CVE-2022-1388

CVE-2022-1388 BIG-IP iControl REST vulnerability CVE-2022-1388 This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services...

CVE-2026-11732

Certain NETGEAR router models (including RAX and CAX series) are vulnerable to an insufficient input validation vulnerability within the Block Sites feature. A network-adjacent attacker with network access, such as WiFi credentials , can exploit this flaw to execute unauthorized commands on the r...

CVE-2019-9193

EN GenPostgresRCEExploit is a PoC tool designed to exploit an authenticated Remote Code Execution RCE vulnerability in certain versions of PostgreSQL 9.3 - 11.7. It allows authenticated users to execute system commands on a PostgreSQL database server vulnerable to CVE-2019-9193. Features...

CVE-2026-77096 CVFS Missing Authentication

CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-77096

CVFS is impacted by a missing authentication condition that can affect command execution . The vulnerability allows for unauthorized actions due to the lack of proper authentication checks. To remediate this issue, software customers should upgrade to the resolved maintenance release and update C...

CVE-2026-77099 CVFS Command Execution

CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-77099

The CVFS component is vulnerable to an input validation issue that allows for command execution . Impacted software customers are advised to upgrade to the resolved maintenance release to remediate the issue. No specific affected versions or exploit details are provided in the documents.

mcpshield

mcpshield A drop-in fix for the unpatched MCP STDIO command-injection flaw the CVE-2026-30623 family, disclosed by OX Security in April 2026 as "by design" -- no SDK patch is coming. Import one line, and every stdio MCP server your Python app launches gets its command/args/env validated before th...

Windows Update Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Update allows an authorized attacker to elevate privileges locally...

Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

Microsoft Office OneNote Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network...

Azure CycleCloud Remote Code Execution Vulnerability

Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...

Windows Shell Security Feature Bypass Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

CVE-2025-10035

CVE-2025-10035 — Fortra GoAnywhere MFT License Servlet Deserialization RCE Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here. A perfect-10 deserialization chain in Fortra GoAnywhere MFT: a forged license response signature lets an...

CVE-2017-10271

weblogicwlswsatrce Weblogic wls-wsat component deserialization vulnerability CVE-2017-10271 exploit script, modified fromhttps://github.com/s3xy/CVE-2017-10271. Command execution with echo output Direct shell upload Tested on Linux with weblogic 10.3.6.0 OK Usage and Parameters python...

CVE-2026-73570

CVE-2026-73570 CVE-2026-73570 PoC More echo 'EHLO mx-1787907797.invalid MAIL FROM: RCPT TO: QUIT\r\n' | nc 127.0.0.1 587...

CVE-2012-2982

CVE-2012-2982 John Hammond | September 4th, 2021 Checking searchsploit for Webmin 1.580 I only saw a Metasploit module for the /file/show.cgi Remote Code Execution attack on that legacy Webmin version. This code is an attempt to recreate that in Python without using Metasploit. Files...