EUVD-2026-95166

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root sshconfigwrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges...

CVE-2026-84278

IBM Security Guardium Data Protection version 12.2 is vulnerable to a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands via attacker-controlled arguments, leading to command execution with root privil...

CVE-2026-84278 IBM Guardium Data Protection Command Injection

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root sshconfigwrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges...

tlsenum

tlsenum tlsenum est un outil d'énumération TLS en ligne de commande qui tente d'énumérer les suites de chiffrement TLS qu'un serveur prend en charge et de les lister par ordre de priorité. Il fonctionne en envoyant des messages TLS ClientHello et en analysant les réponses ServerHello du serveur...

DoHC2

⚠️ NOTE : Cet outil n'est plus activement maintenu. DoHC2 DoHC2 permet d'exploiter la bibliothèque ExternalC2 de Ryan Hanson https://github.com/ryhanson/ExternalC2 pour le commandement et contrôle C2 via DNS over HTTPS DoH. Cet outil est conçu pour le logiciel populaire de simulation d'adversaires...

r2s

React2Shell R2S - Outil de Test CVE-2025-55182 Outil avancé de test d'exploitation pour l'évaluation de la vulnérabilité CVE-2025-55182 Fonctionnalités • Installation • Utilisation • Environnement de test • Juridique 📖 Qu'est-ce que R2S ? R2S React2Shell est un outil de test de sécurité conçu pou...

gcat

Gcat Стелс-бэкдор на Python, использующий Gmail в качестве сервера управления и контроля Этот проект был вдохновлён оригинальным PoC-кодом от Бенджамина Доннелли Это PoC-код... ... который был выпущен для организаций, чтобы они могли проверить свою защиту от атак такого типа. Для их обнаружения...

EUVD-2026-95151

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent contex...

CVE-2026-107322 OS command injection in Amazon Agent Plugins for AWS databases-on-aws

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent contex...

CVE-2026-107322

The Amazon Agent Plugins for AWS databases-on-aws plugin, in versions prior to 1.7.1 , is vulnerable to an OS command injection (CWE-184). An attacker can execute arbitrary operating system commands on the host running the helper by providing a crafted database command value within the agent cont...

FortiSandbox-RCE-Exploit-CVE-2026-39808

Scanner RCE FortiSandbox — CVE-2026-39808 Injection de commandes OS non authentifiée en tant que root dans Fortinet FortiSandbox Vulnérabilité • Installation • Utilisation • Fonctionnement • Pipeline • Dorks Shodan • Avertissement Vulnérabilité CVE-2026-39808 est une vulnérabilité critique...

CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

CVE-2026-107704

The image_optimizer Ruby gem versions 1.3.0 through 1.9.0 contains an OS command injection vulnerability in the ImageOptimizer#identify_format function. When the identify option is enabled, an attacker who can control the image path—such as through an uploaded file name—can append shell metachara...

EUVD-2026-95149

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

CVE-2026-107703 @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-107703

The @enmaso/node-convert library (versions through 1.0.0) contains an OS command injection vulnerability in the convert.js component. The root cause is the use of unsanitized filepath and convertTo arguments when executing ImageMagick commands via child_process.exec() . Attackers can inject shell...

EUVD-2026-95148

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-107699

The ppt2png utility (versions through 0.0.6 ) is vulnerable to an OS command injection vulnerability. The root cause is the use of unsanitized input or output path arguments in the ppt2png.js file, specifically where shell metacharacters (e.g., ';' ) are passed to child_process.exec() . This allo...