PhpWiki Ploticus RCE (CVE-2014-5519)

Exploits CVE-2014-5519 command injection in the Ploticus device attribute via edit preview on index.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """PhpWiki Ploticus device command injection RCE CVE-2014-5519 — execute session.""" from future import...

VICIdial manager_send.php RCE (CVE-2013-4468)

Exploits CVE-2013-4468 command injection via the extension parameter on /agc/managersend.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """VICIdial managersend.php command injection RCE CVE-2013-4468 — execute session.""" from future import annotations import...

Basilic diff.php RCE

Exploits command injection in Basilic = 1.5.14 via the file parameter on /Config/diff.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Basilic Config/diff.php command injection RCE — execute session.""" from future import annotations import re from...

ESVA - learn-msg.cgi RCE (CVE-2012-10046)

Exploits CVE-2012-10046 by injecting OS commands into the id parameter of /cgi-bin/learn-msg.cgi. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ESVA learn-msg.cgi command injection CVE-2012-10046 — execute session.""" from future import annotations import re...

Mundi Mail mypid Command Injection RCE

Exploits command injection in Mundi Mail via the mypid parameter on /admin/status/index.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Mundi Mail mypid command injection — execute session.""" from future import annotations import re from kittysploit import...

Monitorix Pipe RCE (CVE-2013-7070)

Exploits CVE-2013-7070/7071 by injecting commands into pipe-wrapped Monitorix URL paths. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Monitorix pipe path command injection RCE CVE-2013-7070 — execute session.""" from future import annotations import re from...

EUVD-2026-70916

XING CPTrans-ME-X contains an OS Command Injection CWE-78. Unauthenticated OS command may be injected...

CVE-2026-62928

XING CPTrans-ME-X contains an OS Command Injection CWE-78. Unauthenticated OS command may be injected...

CVE-2026-62928

XING CPTrans-ME-X , a rack accessory product, contains an OS Command Injection vulnerability (CWE-78) that allows unauthenticated attackers to inject arbitrary OS commands. The flaw carries a CVSS 9.8 CRITICAL score (v3.0) with high impact on confidentiality, integrity, and availability, indicati...

CVE-2026-62928

XING CPTrans-ME-X contains an OS Command Injection CWE-78. Unauthenticated OS command may be injected...

EUVD-2026-70815

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAYMOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAYMOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process...

EUVD-2026-70768

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

EUVD-2026-70766

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated...

CVE-2026-75161: Improper Neutralization of Special Elements used in a Command

An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to inject arbitrary code into the dpcheck system utility executed as root...

PT-2026-85409

Name of the Vulnerable Software and Affected Versions XING CPTrans-ME-X affected versions not specified Description XING CPTrans-ME-X contains an OS Command Injection flaw, which allows an unauthenticated user to inject and execute arbitrary operating system commands. Recommendations At the momen...

VulnCheck KEV: CVE-2026-58457

Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02 contains an unauthenticated OS command injection vulnerability that allows network-adjacent attackers to execute arbitrary shell commands by injecting unsanitized input through the smacfilterconf handler in the commuos web backend. Attackers...

CVE-2026-85696: Improper Neutralization of Special Elements used in an OS Command

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

PT-2026-85582

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

PT-2026-85565

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...

CVE-2026-85656: Improper Neutralization of Special Elements used in an OS Command

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters...