CVE-2026-58457

CVE-2026-58457 - Unauthenticated OS Command Injection in Shenzhen Aitemi M300 Wi-Fi Repeater !WARNING This code is provided AS IS for educational and research purposes only. Do not use this PoC on production systems, shared environments, or any unauthorized targets. Running or hosting this code m...

CVE-2025-69212-PoC

CVE-2025-69212 — OpenSTAManager P7M Command Injection PoC OpenSTAManager = 2.9.8 — OS Command Injection via malicious .p7m filename in ZIP upload. File: src/Util/XML.php:100 — unsanitized $file in exec Vector: /plugins/importFEZIP/actions.php → ZIP → .p7m filename → exec"openssl smime ... -in...

CVE-2026-105487 yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomaindiscovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

CVE-2026-105487

The yogeshojha reNgine software (versions up to 2.2.0 ) is vulnerable to an OS command injection vulnerability within the listTargets Endpoint . Specifically, the subdomain_discovery function located in the web/reNgine/tasks.py file fails to properly neutralize the Name argument. This flaw allows...

CVE-2026-105487 yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomaindiscovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

EUVD-2026-92917

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomaindiscovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

CVE-2026-105487 yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomaindiscovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

CVE-2025-55182-POC

CVE-2025-55182 – Command Injection Vulnerability Scanner Full Proof-of-Concept With Real Command Output This repository contains a Python-based proof-of-concept PoC scanner for CVE-2025-55182, demonstrating how an attacker could exploit a command injection vulnerability through a JSON-based POST...

CVE-2026-25089

CVE-2026-25089 - Draft - Fortinet FortiSandbox ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone...

EUVD-2026-92908

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652B20230116. The impacted element is the function firmwarecheck of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument filename leads to os command injection. The attack...

CVE-2026-105484 TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652B20230116. The impacted element is the function firmwarecheck of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument filename leads to os command injection. The attack...

CVE-2026-105484 TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652B20230116. The impacted element is the function firmwarecheck of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument filename leads to os command injection. The attack...

CVE-2026-105484

The TOTOLINK X6000R running firmware version 9.4.0cu.652_B20230116 is vulnerable to an OS command injection vulnerability. The flaw exists within the UploadFirmwareFile Handler component, specifically in the firmware_check function of the /cgi-bin/cstecgi.cgi file. An attacker can exploit this by...

cve-2020-24572

CVE-2020-24572 Se descubrió un problema en includes/webconsole.php en RaspAP 2.5. Con acceso autenticado, un atacante puede utilizar una consola web mal configurada y prácticamente sin restricciones para atacar el sistema operativo subyacente que ejecuta este software, y ejecutar comandos en el...

PT-2026-107313

In ssh in OpenSSH before 10.6, a $ or character can occur in a command-line username, leading to injection...

PT-2026-106726

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

An input validation and command injection vulnerability exists in the firmware download and upgrade component of Brocade Fabric OS

: Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control...

Authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS

: An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames across the fabric, the receiving switch processes these...

Command Injection Vulnerabilities in Brocade Fabric OS Management Interface and Authentication Workflows

: Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow...

Command Injection via Unsanitized Remote Brocade Fabric OS Configuration Import Utility

: An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host...