87 matches found
CVE-2024-23692
CVE-2024-23692 BURP POC root@kitploit: GET /?n=%0A&cmd=ipconfig+/all&search=%25xxx%25url:%password%.exec|.?cmd.|timeout=15|out=abc..?n..?n.RESULT:.?n..^abc.====.?n. HTTP/1.1 Host: xxxx User-Agent: Mozilla/5.0 X11; Linux x8664; rv:109.0 Gecko/20100101 Firefox/115.0 Accept:...
CVE-2025-24813-apache-tomcat
CVE-2025-24813 Nuclei Template CVE-2025–24813 root@kitploit: nuclei -l list.txt -t CVE-2025–24813.yaml execute shell root@kitploit: http://target.com/updates.jsp?cmd=whoami...
CVE-2024-29269-EXPLOIT
CVE-2024-29269 - Telesquare TLR-2005KSH Remote Code Execution RCE An issue has been identified in Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 that may allow attackers to execute arbitrary system commands by exploiting the Cmd parameter. This vulnerability could potentially enable unauthorized...
Astra Linux – Vulnerability in Mercurial
A vulnerability was discovered in Mercurial SCM 4.5.3/71.19.145.211. This vulnerability is considered problematic. It affects unknown code within the Web Interface component. Manipulating the cmd argument leads to cross-site scripting attacks. The attack can be initiated remotely. The exploit has...
CVE-2026-15991 File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter
The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...
CVE-2026-15991
The File Manager WordPress plugin (versions 6.0–6.9) is affected by an access control flaw in its elFinder integration. Insufficient file path validation in the connector allows an authenticated user with subscriber-level access or higher to read and delete arbitrary server files via a cmd parame...
OESA-2026-2729 mercurial security update
Mercurial is a free, distributed source control management tool. It efficiently handles projects of any size and offers an easy and intuitive interface. Security Fixes: A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects...
D-Link多款产品 访问控制错误漏洞
D-Link DNS-120, etc., are products of D-Link Corporation, a Chinese company. The D-Link DNS-120 is a network storage adapter. The D-Link DNR-202L is a network video camera. The D-Link DNS-315L is a network attached storage device. Several D-Link products have a vulnerability related to access...
PT-2026-5824
Victor CMS 1.0 contains an authenticated file upload vulnerability that allows administrators to upload PHP files with arbitrary content through the user image parameter. Attackers can upload a malicious PHP shell to the /img/ directory and execute system commands by accessing the uploaded file...
CVE-2023-29915
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via CMD parameter at /goform/aspForm...
CVE-2023-4542
A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The manipulation of the argument cmd with the input id leads to os command injection. It is possible to initiate the attack remotely. The...
CVE-2025-15357 D-Link DI-7400G+ msp_info.htm command injection
A vulnerability was found in D-Link DI-7400G+ 19.12.25A1. This affects an unknown function of the file /mspinfo.htm?flag=cmd. The manipulation of the argument cmd results in command injection. The attack can be launched remotely. The exploit has been made public and could be used...
CVE-2024-58314
Atcom 100M IP Phones firmware version 2.7.x.x contains an authenticated command injection vulnerability in the web configuration CGI script that allows attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'cmd' parameter in webcgimain.cgi, enabling remot...
CVE-2024-58314
CVE-2024-58314 affects Atcom 100M IP Phones firmware v2.7.x.x. An authenticated command-injection vulnerability exists in the web configuration CGI script, allowing execution of arbitrary system commands via the cmd parameter in web_cgi_main.cgi . This enables remote code execution with administr...
EUVD-2002-0227
Malware in sbrugna...
EUVD-2007-4130
Malware in sbrugna...
EUVD-2004-2310
Malware in sbrugna...
EUVD-2018-17457
Malware in sbrugna...