CVE-2024-36401

CVE-2024-36401 GeoServer Exploitation Tool Vulnerability Overview CVE-2024-36401 is a remote command execution vulnerability in GeoServer. An attacker can execute arbitrary commands without authorization by crafting a specific WFS Web Feature Service request. Requirements Python 3.x Install...

CVE-2022-1388

Vuln Impact This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. Vuln Product F5 BIG-IQ 11.6.1 - 11.6.5 F5 BIG-IP...

CVE-2019-16278

CVE-2019-16278 CVE-2019-16278Nostromo httpd Command Execution ➜ Downloads python nostromo.py 114.114.114.114 8080 pwd /bin ➜ Downloads python nostromo.py 114.114.114.114 8080 id uid=65534 gid=65534 ➜ Downloads python nostromo.py 114.114.114.114 8080 "ls -al" drwxr-xr-x 2 0 0 0 Apr 12 2013...

SolarView 6.00 - Remote Command Execution

SolarView Compact 6.00 is vulnerable to a command injection via networktest.php. id: CVE-2022-40881 info: name: SolarView 6.00 - Remote Command Execution author: For3stCo1d severity: critical description: | SolarView Compact 6.00 is vulnerable to a command injection via networktest.php. impact: |...

TurboMeeting - Post-Authentication Command Injection

The Certificate Signing Request CSR feature in the admin portal of the application is vulnerable to command injection. This vulnerability could allow authenticated admin users to execute arbitrary commands on the underlying server by injecting malicious input into the CSR generation process. The...

DATAGERRY - REST API Auth Bypass

Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests. id: CVE-2024-46627 info: name: DATAGERRY - REST API Auth Bypass author: gy741 severity: critical description: | Incorrect access control in BECN DATAGERRY v2.2 allows attackers...

Belkin Linksys RE6500 <1.0.012.001 - Remote Command Execution

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page. id: CVE-2020-35713 info: name: Belkin Linksys RE6500 1.0.012.001 - Remote Command Execution author: gy741 severity:...

Viessmann Vitogate 300 - Remote Code Execution

In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method. id: CVE-2023-45852 info: name: Viessmann Vitogate 300 - Remote Code Execution autho...

CVE-2026-16723

CVE-2026-16723 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments...

CVE-2021-3129

CVE-2021-3129 Laravel RCE CVE-2021-3129 Test Environment mkdir CVE-2021-3129-docker cd CVE-2021-3129-docker wget https://raw.githubusercontent.com/vulhub/vulhub/master/laravel/CVE-2021-3129/docker-compose.yml docker compose up -d Usage git clone https://github.com/miko550/CVE-2021-3129.git cd...

Traccar - Unrestricted File Upload

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

CVE-2026-114612

A flaw was found in LiteLLM. The proxy server reuses the same cryptographic key for encrypting stored data and generating session authentication tokens. An authenticated attacker can exploit this flaw by submitting crafted metadata to obtain an encrypted administrator credential, which can then b...

CVE-2026-52356

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters...

CVE-2026-52356

The D-Link DAP1160L A1_FW101WWb04 is affected by an OS command injection vulnerability located in the /htdocs/web/diagnostic.php endpoint. Attackers can exploit this flaw by injecting arbitrary shell metacharacters to execute commands on the underlying operating system. Specific details regarding...

CVE-2026-52356

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters...

EUVD-2026-109093

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters...

PT-2026-122148

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1 FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters...

CVE-2026-95704

A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially...

CVE-2026-95709

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying...

CVE-2026-95711

An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are...