PT-2026-80530

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby...

Exploit for CVE-2026-44402

CVE-2026-44402 Pre-Authenticated Full Remote Command Executio...

QNAP - pingping.cgi Command Injection (CVE-2013-0143)

Exploits CVE-2013-0143 via /cgi-bin/pingping.cgi?pingip=1;;. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP pingping.cgi RCE CVE-2013-0143 — opens execute session.""" import base64 import re from urllib.parse import quote from kittysploit import from...

Bash Shellshock - HTTP CGI Detection (CVE-2014-6271)

Detects Shellshock by injecting :;; id into User-Agent/Referer/Cookie against common CGI paths and matching uid=/gid=. !/usr/bin/env python3 -- coding: utf-8 -- """GNU Bash Shellshock HTTP CGI RCE CVE-2014-6271 / CVE-2014-6278.""" import re from kittysploit import from lib.protocols.http.httpclie...

Apache HTTP Server 2.4.49 - CGI Path Traversal RCE (CVE-2021-41773)

Exploits CVE-2021-41773 by POSTing shell commands to an encoded path ending in bin/sh under a mapped Alias/ScriptAlias cgi-bin/icons. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49 CGI path-traversal RCE CVE-2021-41773 — opens execute...

Apache HTTP Server 2.4.49 - Path Traversal / RCE Detection (CVE-2021-41773)

Detects CVE-2021-41773 by reading /etc/passwd via encoded /.%%2e/ traversal under /cgi-bin or /icons, and optionally confirming CGI RCE via POST to bin/sh. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49 path traversal / CGI RCE CVE-2021-41773.""" import re from kittysploit...

DD-WRT - cgi-bin Command Injection Detection (CVE-2009-2765)

Detects CVE-2009-2765 by requesting /cgi-bin/;id&N and matching uid=/gid=. !/usr/bin/env python3 -- coding: utf-8 -- """DD-WRT cgi-bin command injection CVE-2009-2765.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

D-Link DNS-320/325 - system_mgr.cgi RCE Detection

Detects D-Link ShareCenter RCE via /cgi-bin/systemmgr.cgi?cmd=cgismstest&command1=id. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320/325 systemmgr.cgi command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

D-Link DAP-2020 - webproc File Read (CVE-2021-27250)

Reads arbitrary files from D-Link DAP-2020 via POST /cgi-bin/webproc errorpage= parameter CVE-2021-27250. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAP-2020 webproc errorpage arbitrary file read CVE-2021-27250.""" from kittysploit import from lib.protocols.http.httpclient import...

Apache HTTP Server 2.4.49-2.4.50 - CGI Path Traversal RCE (CVE-2021-42013)

Exploits CVE-2021-42013 using double-encoded .%%32%65/ traversal to reach bin/sh under a mapped Alias/ScriptAlias and run OS commands. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49-2.4.50 double-encoded CGI RCE CVE-2021-42013 — opens...

AVTECH - Machine.cgi Capability Disclosure Detection

Detects AVTECH unauthenticated information disclosure via /cgi-bin/nobody/Machine.cgi?action=getcapability. !/usr/bin/env python3 -- coding: utf-8 -- """AVTECH devices unauthenticated capability disclosure CVE-2016-15047 family.""" from kittysploit import from lib.protocols.http.httpclient import...

Bash Shellshock - HTTP CGI RCE (CVE-2014-6271)

Exploits Shellshock via User-Agent injection against a CGI path. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Bash Shellshock HTTP CGI RCE CVE-2014-6271 — opens execute session.""" import re from kittysploit import from lib.protocols.http.httpclient import...

CVE-2026-19379

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and...

EUVD-2026-54974

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and...

CVE-2026-19379

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and...

CVE-2026-19379

CVE-2026-19379 affects EFM ipTIME AX8004M (firmware 15.09.0) where the popen function in /cgi/d.cgi under CGI Endpoint can be abused to inject commands via fname. The issue enables remote code execution and is supported by public disclosure; exploitation maturity is PROOF-OF-CONCEPT per the CVSS ...

CVE-2026-19379: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and...

PT-2026-69323

Name of the Vulnerable Software and Affected Versions EFM ipTIME AX8004M version 15.09.0 Description A remote OS command injection exists within the CGI Endpoint component. The issue occurs when the popen function in the '/cgi/d.cgi' endpoint improperly handles the fname argument, allowing an...

CVE-2026-71288: Improper Neutralization of Special Elements used in an SQL Command

Koha's guided report builder reports/guidedreports.pl reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders,...

GL.iNet GL-MT3000 Router set_upgrade() Command Execution

The vulnerability of the setupgrade function at the /cgi-bin/glc endpoint of the modem.so component of the GL.iNet GL-MT3000 router software lies in the lack of measures to sanitize input data. Exploiting this vulnerability could allow an attacker to inject arbitrary commands remotely...