NUUO Camera <=20250203 - OS Command Injection

NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handleconfig.php, letting remote attackers execute arbitrary commands, exploit requires remote access. id: CVE-2025-1338 info: name: NUUO Camera =20250203 - OS Command Injection author: Ark...

D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injection

OS Command injection vulnerability in D-Link DIR820LA1FW105B03 allows attackers to escalate privileges to root via a crafted payload with the pingaddr parameter to ping.ccp. id: CVE-2023-25280 info: name: D-Link DIR820LA1FW105B03 'pingaddr' - OS Command Injection author: pussycat0x severity:...

rConfig <= 3.9.4 - Authenticated OS Command Injection

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.9.4 does not properly sanitize the fileName POST parameter before using it in a shell command, allowing an authenticated attacker to inject arbitrary OS commands. This template uses default admin credentials to log in before triggering the...

Advantech R-SeeNet 2.4.12 - OS Command Injection

Advantech R-SeeNet 2.4.12 is susceptible to remote OS command execution via the ping.php script functionality. An attacker, via a specially crafted HTTP request, can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering...

cPH2 Charging Station v1.87.0 - OS Command Injection

An OS command injection vulnerability in Hardy Barth cPH2 Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature. id: CVE-2023-46359 info: name: cPH2...

MajorDoMo thumb.php - OS Command Injection

MajorDoMo aka Major Domestic Module before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager. id: CVE-2023-50917 info: name: MajorDoMo thumb.php - OS Command Injection author: DhiyaneshDK severity: critical...

Palo Alto Networks Expedition - OS Command Injection

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls...

WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection

A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection...

Node.js Embedded JavaScript 3.1.6 - Template Injection

Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settingsview optionsoutputFunctionName, which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation. id:...

CVE-2019-17625

CVE-2019-17625 There is a stored XSS vulnerability in rambox 0.6.9 due to unsantized parameters in the name field when a user is adding a service. Since rambox runs on NodeJS this allows for the use of OS commands to be injected into an or tag. Note: This code has only been tested on MacOS and ma...

CVE-2023-33381-MitraStar-GPT-2741GNAC

CVE-2023-33381-MitraStar-GPT-2741GNAC CVE-2023-33381: OS command injection on MitraStar GPT-2741GNAC Device: GPT-2741GNAC Firmware Version: ARg5.8110WVN0b72 Vulnerability Description: Upon logging in via SSH, I immediately noticed the limited set of available commands and options. It became evide...

CVE-2025-34030-PoC

CVE-2025-34030 - sar2html 'plot' parameter RCE CVSS: 10.0 Critical Vulnerability: OS Command Injection Programming Language: PHP Exploit Code: Python References: https://nvd.nist.gov/vuln/detail/CVE-2025-34030 https://www.vulncheck.com/advisories/sar2html-command-injection Description sar2html...

CVE-2022-30525_check

CVE-2022-30525check Description: This script checks for the presence of the OS command injection vulnerability CVE-2022-30525 in Zyxel USG FLEX devices running firmware versions 5.00 through 5.21 Patch 1. The vulnerability allows an attacker to modify specific files and execute OS commands on a...

ip-camera-research

IP Camera Research - Fullhan FH8626V100 AJL30PG0803 Security research on a consumer IP camera built on the Fullhan FH8626V100 SoC model AJL30PG0803, resulting in six assigned CVEs covering unauthenticated API access, plaintext credential disclosure, and full unauthenticated device compromise via ...

poc-yaws-cgi-shell-injection

OS command injection in Yaws web server CVE-2020-24916 Proof of concept Build test image: docker build -t vulnbe/yaws-pocs:shell-injection-appmod-cgi -f Dockerfile . and/or Run container docker run --rm -d -i -p 127.0.0.1:8000:8080 vulnbe/yaws-pocs:shell-injection-appmod-cgi root@kitploit: curl...

CVE-2026-42167-PoC

CVE-2026-42167 POC Pre-Authentication Remote Code Execution in ProFTPD via modsql SQL Injection Author: Van Glenndon Enad Original Discovery: ZeroPath Published: May 1, 2026 Severity: Critical CVSS v3.1 Score: 8.1 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v2 Score: 7.6...

CVE-2026-34940

CVE-2026-34940 — OS Command Injection in KubeAI via Model URL in Ollama startup probe Severity : High CVSS 8.7 CWE : CWE-78 — Improper Neutralization of Special Elements used in an OS Command Affected : github.com/kubeai-project/kubeai = 0.23.1 Fixed in : 0.23.2 Advisory : GHSA-324q-cwx9-7crr NVD...

CVE-2025-57457

OS Command Injection in CURO UC300 IP Phone An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter. PoC: https://github.com/restdone/CVE-2025-57457/blob/main/oscommandinject.mp4 Step...

CVE-2024-12856

CVE-2024-12856 This is an exploit for Four-Faith router models F3x24 and F3x36 to get a reverse shell. "The Four-Faith router models F3x24 and F3x36 are affected by an operating system OS command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to...

CVE-2022-30525

CVE-2022-30525 A OS Command Injection Vulnerability in the CGI Program of Zyxel Executive Summary The vulnerability, first discovered on April 13, 2022, caused remote code execution in Zyxel firewall products. This important vulnerability with a CVSS score of 9.8 was blocked with the update...