wp2shell

wp2shell Pre-authentication remote code execution for WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Chains CVE-2026-63030 batch route confusion SQLi with CVE-2026-60137 customizer changeset re-entry to achieve unauthenticated administrator creation and OS command execution. No password cracking required...

CVE-2025-56803

CVE-2025-56803 Vulnerabilidad de inyección de comandos del sistema operativo mediante la ejecución de plugins en la aplicación de escritorio de Figma 1. Resumen Aplicación : Figma Desktop Application Versión : 125.6.5 Proveedor : Figma, Inc. CWE : CWE-78: Neutralización incorrecta de elementos...

CVE_2024_20356

CVE-2024-20356 Esta es una prueba de concepto para CVE-2024-20356, una vulnerabilidad de inyección de comandos en Cisco CIMC. Escrito por Aaron y oxidado por SherllyNeo Los detalles técnicos completos se pueden encontrar en...

CVE-2024-29375

CSV-Injection-PoC Inyección CSV en Addactis IBNRS 3.10.3.107 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L CVSS: 7.1, Puntuación de Impacto: 5.3, Puntuación de Explotación: 1.3 Componentes Afectados: parámetros de Descripción del Proyecto, Identificadores, Nombre del Triángulo Personalizado dentro de...

CVE-2021-27928

Información root@kitploit: Exploit Title: MariaDB 10.2 /MySQL - 'wsrepprovider' OS Command Execution Date: 03/18/2021 Exploit Author: Central InfoSec Version: MariaDB 10.2 antes de 10.2.37 10.3 antes de 10.3.28 10.4 antes de 10.4.18 10.5 antes de 10.5.9 Percona Server hasta 2021-03-03; y el parch...

CVE-2024-27348

CVE-2024-27348 🪶 CVE-2024-27348 Proof of concept Exploit RCE in Apache HugeGraph Server Unauthenticated users can execute OS commands via Groovy injection in Apache HugeGraph Server. Usage 🛠 Exploit multiple targets ☣️ root@kitploit: python3 CVE-2024-27348.py -f targets.txt -c "command to execute"...

beyondtrust-rce-scanner

CVE-2026-1731 — BeyondTrust Remote Support & PRA Pre-auth RCE Overview Critical pre-authentication RCE in BeyondTrust Remote Support and Privileged Remote Access. Unauthenticated remote attacker can execute OS commands...

CVE-2026-90444

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-63077

Overview • Visual Flow • Requirements • Usage • Limitations • Mitigation !CAUTION This PoC executes an operating-system command and can modify the TeamCity application directory. Use it only in an isolated lab or against systems for which you have explicit written authorization. ⚡ Overview...

CVE-2021-27928

CVE-2021-27928 En este repositorio, encontrarás una prueba de concepto de la explotación de la vulnerabilidad CVE-2021-27928 a través de un contenedor docker. root@kitploit: Exploit Title: MariaDB 10.2 /MySQL - 'wsrepprovider' OS Command Execution Date: 03/18/2021 Exploit Author: Central InfoSec...

CVE-2026-79724

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command...

CVE-2026-19136

A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application...

CVE-2026-19136

A potential command injection vulnerability affects the Tianxi AI Agent PC Application , distributed exclusively in the Chinese market. If a local user opens a specially crafted link handled by the application, it could allow execution of operating system commands, resulting in high impact to con...

EUVD-2026-75751

A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application...

EUVD-2026-75586

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

CVE-2019-9193-Home-Lab

CVE-2019-9193 — PostgreSQL COPY FROM PROGRAM RCE INGLÉS ABAJO Este laboratorio simula la vulnerabilidad CVE-2019-9193 presente en PostgreSQL versión 9.3 - 11.2, que permite a los usuarios superuser o con el rol pgexecuteserverprogram usar el comando: root@kitploit: COPY ... FROM PROGRAM '' para...

gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility

A flaw was found in gpsd. This code injection vulnerability in the gpsprof utility allows an attacker to execute arbitrary operating system OS commands. By controlling GPS input data, an attacker can inject malicious content into the SKY.satellites.used field. This unsanitized input is then...

CVE-2022-40635

CVE-2022-40635: Omisión del Sandbox de Groovy en CrafterCMS Vulnerabilidad de Control Inadecuado de Recursos de Código Gestionado Dinámicamente en Crafter Studio de Crafter CMS que permite a desarrolladores autenticados ejecutar comandos del sistema operativo mediante la omisión del Sandbox de...

CVE-2026-73751

CVE-2026-73751 is an authenticated remote command injection in the AOS-CX (Aruba) web-based management interface, assigned by HPE . An authenticated user with low-privileged access can submit crafted input through the web interface to execute arbitrary commands on the underlying operating system,...

CVE-2026-73751 Authenticated Remote Command Injection in AOS-CX Web-based Management Interface

An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system...