CVE-2025-71429 GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $... in the UVR5 WebUI output folder textboxes with mp3 or m4a export...

EUVD-2025-211070

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $... in the UVR5 WebUI output folder textboxes with mp3 or m4a export...

CVE-2025-71429

Versions of GPT-SoVITS up to and including 20250606v2pro are vulnerable to an OS command injection vulnerability in the tools/uvr5/vr.py component. The root cause is the improper neutralization of special elements, allowing unauthenticated attackers to execute arbitrary commands as the server use...

EUVD-2020-31276

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $ ...

CVE-2020-37279 easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $ ...

CVE-2020-37279

The easy-pdf-merge library, versions 0.1.0 through 0.2.6 , is vulnerable to an OS command injection vulnerability. The flaw exists because the software fails to properly sanitize shell metacharacters—such as double quotes, semicolons, $(), or backticks—when processing the source path , destinatio...

CVE-2021-25646-exp

CVE-2021-25646-exp Apache Druid CVE-2021-25646 Remote Code Execution Vulnerability Detection and Exploitation Tool Input domain name or ip:port to perform vulnerability detection For targets where the vulnerability is detected, command execution exploitation can be performed Supports single targe...

aapanel

aapanel aapanel 6.6.6 - CVE-2020-14950 Description : allows remote authenticated users to execute arbitrary commands via the setting menu of Sotfware Store. Affected version : All = 6.6.6 Information To make this PoC, I just installed the software using docker-compose Vulnerability Type : Remote...

CVE-2022-29337

CVE-2022-29337 C-DATA FD702XW-X-R430 v2.1.13X001 was discovered to contain a command injection vulnerability via the vacmd parameter in formlanipv6. This vulnerability allows attackers to execute arbitrary commands via a crafted HTTP request...

CVE-2021-3129

Remote Code Execution: Laravel CVE-2021-3129 📜 Description This script is designed to exploit the Remote Code Execution RCE vulnerability identified in several Laravel versions, known as CVE-2021-3129. By leveraging this vulnerability, the script allows users to write and execute commands on a...

CVE-2022-24086

CVE-2022-24086 PoC of CVE-2022-24086 var this.getTemplateFilter.addAfterFilterCallback"system".filter"whoami"...

CVE-2025-53652-Jenkins-Git-Parameter-Analysis

CVE-2025-53652: Jenkins Git Parameter Plugin Unvalidated Input Vulnerability. Summary This vulnerability arises because user-controlled input from Jenkins build parameters is injected unsafely into the Git checkout command. User input is provided as a build parameter e.g., gitParameters, which ca...

CVE-2004-2687

CVE-2004-2687 DistCC Daemon Command Execution...

CVE-2021-43469

CVE-2021-43469 Exploit Title: VINGA router has weak passwords and background command execution vulnerabilities. product: VINGA WR-N300U webserver: goahead Author: CXAQHQ TIME: 2021-11-01 Command execution vulnerabilities exist on the Ping and traceroute interfaces after login. Run the IP addr...

ATutor-Instructor-Backup-Arbitrary-File

ATutor-Instructor-Backup-Exploit Exploit Title: ATutor 2.2.4 'Backup' Remote Command Execution CVE-2019-12170 Google Dork: inurl:/ATutor/login.php Date: 5/13/2019 Exploit Author: liquidsky Joseph McPeters Vendor Homepage: https://atutor.github.io/ Software Link:...

CVE-2021-41773

CVE-2021-41773 - Remote Code Execution in Apache 2.4.49 PoC for CVE-2021-41773 as I just found over-complicated exploits and this one goes straight to the Remote Code Execution. Usage Just specify the IP address running the vulnerable Apache 2.4.49 server with -i and the desired system command wi...

CVE-2011-2523

CVE-2011-2523 - vsftpd 2.3.4 Exploit Description Very Secure FTP Daemon vsftpd is an FTP server for Unix-like platforms, including Linux. It is distributed under the terms of the GNU General Public Licence. It supports IPv6 as well as SSL. It was revealed in July 2011 that vsftpd version 2.3.4,...

CVE-2026-39808

CVE-2026-39808 On November 2025, a critical vulnerability was discovered on Fortinet's FortiSandbox which allowed an unauthenticated attacker to execute commands in the underlying OS as root. The vulnerability was patched and finally made public on April 2026. This vulnerability affects...

CVE-2022-26134

CVE-2022-26134 -u URL, --url URL Target URL -c COMMAND, --command COMMAND Command -i LHOST, --lhost LHOST Reverse shell host address -p LPORT, --lport LPORT Reverse shell host port -f FILE, --file FILE Batch scan...

zerobox

Zerobox Python SDK Python SDK for zerobox. Sandbox any command with file, network, and credential controls. pip install zerobox Installing the wheel drops the zerobox CLI into your environment's bin/ and exposes a Python SDK. For CLI usage, secrets concepts, the full flag reference, performance...