CVE-2024-10914-Exploit

CVE-2024-10914-Exploit CVE-2024-10914 es una vulnerabilidad crítica que afecta a los dispositivos D-Link DNS-320, DNS-320LW, DNS-325 y DNS-340L hasta la versión 20241028. La función cgiuseradd en el archivo /cgi-bin/accountmgr.cgi?cmd=cgiuseradd es la culpable, ya que permite a los atacantes...

CVE-2026-86530

BUFFALO Wi-Fi products are vulnerable to an arbitrary OS command execution flaw due to improper handling of certain web form inputs when assembling internal command line strings. An administrative user can exploit this by sending a crafted HTTP request . No specific version numbers, root cause fi...

CVE-2022-23935

CVE-2022-23935 El programa de software Exiftool, en versiones anteriores a la 12.38, tiene una vulnerabilidad de seguridad que puede explotarse mediante un nombre de archivo especialmente diseñado. Esta vulnerabilidad permite la inyección de comandos, donde un atacante puede ejecutar comandos...

CVE_2024_20356

CVE-2024-20356 Esta es una prueba de concepto para CVE-2024-20356, una vulnerabilidad de inyección de comandos en Cisco CIMC. Escrito por Aaron y oxidado por SherllyNeo Los detalles técnicos completos se pueden encontrar en...

Vulnerability-Research

🛡️ Vulnerability Research Here, I catalog the vulnerabilities I've discovered, the corresponding write-ups containing details of the weaknesses, and insights into their impact and remediation. 🏆 Assigned CVEs CVE ID| Vulnerability Title| Severity/CVSS| Published| Write-Up ---|---|---|---|--- N.A.|...

CVE-2018-14699

CVE-2018-14699 DroboAccess v2.1 中 enableuser 函数的无认证命令注入 使用方法： 首先启动一个监听器（ncat -nvlp 1337） 然后运行漏洞利用脚本 示例：exploit.py -t 192.168.1.122:8080 -l 192.168.1.2 -p 1337 '-t', '--target', help='用于利用的主机，例如 192.168.1.122:8080', required=True '-l', '--listener-ip', help='监听器 IP', required=True '-p', '--port',...

CVE-2026-101008

A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function mergesplitfile of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument splitfilepath results in command injection. The attack is possible to be...

CVE-2026-101009

A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bttask.unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to os command injection. The attack...

CVE-2026-101007

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

CVE-2026-101009

A vulnerability exists in aaPanel BaoTa versions up to 11.8.0 within the Unzip Handler component. Specifically, the panelTask.bt_task._unzip function in the file /www/server/panel/class/panelTask.py is susceptible to os command injection when an attacker manipulates the Password argument. This at...

EUVD-2026-88106

A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bttask.unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to os command injection. The attack...

EUVD-2026-88104

A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function mergesplitfile of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument splitfilepath results in command injection. The attack is possible to be...

CVE-2026-101008

A command injection vulnerability exists in aaPanel BaoTa up to version 11.8.0 . The flaw is located within the File Merge Handler component, specifically in the merge_split_file function of the /www/server/panel/class/files.py file. By manipulating the split_file_path argument, an attacker can p...

CVE-2026-101008 aaPanel BaoTa File Merge files.py merge_split_file command injection

A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function mergesplitfile of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument splitfilepath results in command injection. The attack is possible to be...

CVE-2020-14883

http://myq-x.remore:8090/index.php?m=WebServiceMgmt::invoke&p="d":"\\m\":"Wsf\\\\Win\\\\Firewall::delete\","\\p\":"----\\\"|ipconfig+/allC:\\\\Windows\\\\system32\\\\spool\\\\drivers\\\\1.txt||----","\\id\":"1","\\pwd\":"","s":"b75c29ef4a5a3d600d96732b3c5cbed1"...

CVE-2026-101007 aaPanel BaoTa Database Backup database.py InputSql os command injection

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

EUVD-2026-88103

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

CVE-2026-101007

A vulnerability exists in aaPanel BaoTa up to version 11.8.0 , specifically within the Database Backup Handler component. The flaw is located in the InputSql function of the class/database.py file. By manipulating the Password argument, an attacker can achieve remote os command injection . Public...

CVE-2024-56115

CVE-2024-56115 Descripción sugerida Existe una vulnerabilidad en Amiro.CMS anterior a 7.8.4 debido a la falta de medidas para neutralizar elementos especiales. Permite a atacantes remotos llevar a cabo un ataque de Cross-Site Scripting XSS. Tipo de vulnerabilidad CWE-78 | Neutralización incorrect...

CVE-2026-101002

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/networktools of the component Tools Ping Handler. Performing a manipulation of the argument url results in os command injection. The attack can be initiated remotely. Th...