CVE-2007-2447

CVE-2007-2447 Vulnerabilidad de inyección remota de comandos CVE-2007-2447, permite a atacantes remotos ejecutar comandos arbitrarios especificando un nombre de usuario de Samba que contenga metacaracteres de shell...

CVE-2007-2447

CVE-2007-2447 - username map script "The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the 1 SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows...

CVE-2025-64155-hunter

Escáner CVE-2025-64155 Un escáner en Python para detectar la vulnerabilidad de inyección de comandos CVE-2025-64155 en el servicio Phoenix Monitor. Descripción CVE-2025-64155 es una vulnerabilidad de inyección de comandos en el servicio Phoenix Monitor que permite la ejecución remota de código a...

CVE-2026-63766_exploit

CVE-2026-63766 — Inyección de comandos del sistema operativo sin autenticación en GPT-SoVITS Ejecución remota de código sin autenticación en la interfaz web de Gradio de GPT-SoVITS webui.py. Las utilidades de procesamiento de audio openasr, openslice, opendenoise, openuvr5 interpolan los valores ...

CVE-2026-11120-Command-Injection-via-Git-URL-in-CI-CD-Pipeline

CVE-2026-11120 – Inyección de comandos a través de la URL de Git en el pipeline de CI/CD Código del programa Python cicdbuild.py - Clones repository without sanitizing URL import subprocess, sys def cloneandbuildrepourl: Vulnerability: repourl can contain shell metacharacters cmd = f"git clone...

Scalar-Venom-Attack

Este artículo analiza vulnerabilidades criptográficas descubiertas en la infraestructura moderna de gestión de claves criptográficas, con especial atención a fallos críticos en la arquitectura de los módulos de seguridad de hardware HSM al manejar claves privadas de curvas elípticas. El estudio s...

CVE-2020-8958

Una prueba de concepto para CVE-2020-8958 escrita en Python. El script devolverá el contenido de /etc/passwd si tiene éxito. CVE-2020-8958 Los dispositivos Guangzhou 1GE ONU V2801RW 1.9.1-181203 hasta 2.9.0-181024 y V2804RGW 1.9.1-181203 hasta 2.9.0-181024 permiten a atacantes remotos ejecutar...

CVE-2026-26830

CVE-2026-26830: Inyección de comandos del sistema operativo en pdf-image Resumen pdf-image a través de la versión 2.0.0 permite la inyección de comandos del sistema operativo mediante el argumento pdfFilePath. El paquete construye cadenas de comandos shell con util.format y las ejecuta con...

smb-usermap

Samba "username map script" Ejecución de comandos Este módulo explota una vulnerabilidad de ejecución de comandos en las versiones de Samba 3.0.20 hasta 3.0.25rc3 cuando se utiliza la opción de configuración no predeterminada "username map script". Al especificar un nombre de usuario que contenga...

cve-2024-10914-port

CVE-2024-10914 portado a rust y python porque sí qué es esto cve-2024-10914 es una vulnerabilidad descubierta recientemente con una puntuación crítica de 9.8 que afecta a algunos routers dlink. como esos routers llegaron a su fin de vida útil EOL, dlink se niega a parchear esta vulnerabilidad...

cve-2015-2208

Dockerfile para simular el entorno para CVE-2015-2208 La función saveObject en moadmin.php de phpMoAdmin 1.1.2 permite a atacantes remotos ejecutar comandos arbitrarios mediante metacaracteres de shell en el parámetro object. Descubierto por: @u0x Pichaya Morimoto, Xelenonz, pe3z, Pistachio...

CentOS Linux 6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-ldap / etc (CENTOS6:CLSA-2026:1778233384)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1778233384 advisory. - In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario wher...

AlmaLinux 9.2 [TuxCare] Security Update: cockpit / cockpit-bridge / cockpit-doc / cockpit-packagekit / etc (ALMALINUX9.2:CLSA-2026:1781091230)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1781091230 advisory. - A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting...

CentOS Linux 7 [TuxCare] Security Update: emacs / emacs-common / emacs-el / emacs-filesystem / emacs-nox / etc (CENTOS7:CLSA-2024:1728055873)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1728055873 advisory. - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c...

PT-2026-103111

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions 1.2.0 through 2.19.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5 Description An authentication bypass exists in the optional sshd-ldap component, which integrates password and public key authentication with an...

CentOS Linux 7 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS7:CLSA-2026:1777627629)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777627629 advisory. - In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario wher...

CVE-2026-102925

A flaw was found in virtualenv. The generated activation scripts for shells such as bash, zsh, and fish apply improper quoting to environment and library path variables. An attacker can exploit this by providing a crafted virtual environment path containing shell metacharacters. When an...

CVE-2026-102925

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

CVE-2026-102925 virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling

A vulnerability in Vim's shell script plugins sh.vim, zsh.vim, ps1.vim allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters...