Moodle SpellChecker Path Authenticated Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Moodle SpellChecker Path Authenticated Remote Command Execution', 'Description' = %q Moodle allows an authenticated administrator to define...

Code Injection in flatcore/flatcore-cms

Description Bypass of remote code execution in https://github.com/flatCore/flatCore-CMS/issues/59 The following payload uses . for concatenation and to execute system commands. Proof of Concept 1 Insert the following as Permalink value lol".whoamipwned.txt." 2 Go to...

CVE-2021-38478

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a traceroute tool to inject commands into the device. This may allow the attacker to remotely run commands on behalf of the device...

CVE-2021-42071

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header...

CVE-2021-42071

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header...

CVE-2021-42071

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header...

CVE-2021-42071

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header...

CVE-2021-42071

CVE-2021-42071 affects Visual Tools DVR VX16 4.2.28.0. An unauthenticated attacker can achieve remote code execution by exploiting shell metacharacters in the cgi-bin/slogin/login.py User-Agent header, via an OS command-injection vector. Exploitation has been demonstrated in public disclosures (E...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 Playground === This is a small Docker recipe for...

PT-2021-23503

Name of the Vulnerable Software and Affected Versions Visual Tools DVR VX16 version 4.2.28.0 Description An unauthenticated attacker can achieve remote command execution via shell metacharacters in the "cgi-bin/slogin/login.py" API endpoint, specifically in the User-Agent HTTP header...

IR615 Router: Operating System Command Injection Vulnerability

The Rimutech IR615 Router is a 4G industrial router from China-based Rimutech. The IR615 Router has an operating system command injection vulnerability that could be exploited by an attacker to remotely run commands on behalf of the device...

Ax-Solutions Visual Tools Dvr Vx16: Operating System Command Injection Vulnerability

Ax-Solutions Visual Tools Dvr Vx16 is a video surveillance system from Ax-Solutions, Inc. It is used for image analysis. An operating system command injection vulnerability exists in Ax-Solutions Visual Tools DVR VX16 4.2.28.0, which allows an unauthenticated attacker to achieve remote command...

CVE-2021-42071: Improper Neutralization of Special Elements used in an OS Command

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header...

VulnCheck KEV: CVE-2021-1473

Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the Details...

VulnCheck KEV: CVE-2021-1472

Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the Details...

HPESBNW04201 rev.2 - HPE Aruba Instant (IAP), Multiple Vulnerabilities

Potential Security Impact: Remote: Arbitrary Command Execution, Denial of Service DoS, Disclosure of Sensitive Information, Unauthorized Read Access to Files, Buffer Overflow SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba 100 Series Access Points - See Details section for...

PT-2021-4344

Name of the Vulnerable Software and Affected Versions Emerson WirelessHART Gateway versions 1420, 1410D, and 1410 Description The issue is related to the microprogram software of Emerson WirelessHART Gateway series 1420, 1410D, and 1410, where it fails to neutralize special elements used in an...

Moxa Mxview Network Management Software injection vulnerability

A code injection vulnerability exists in Moxa MXview, a network management software used to monitor and diagnose industrial networks. The vulnerability stems from improper neutralization of special elements in the output used by downstream components. An attacker could exploit the vulnerability t...

CVE-2021-34352: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210902 and later...

Apache James Server 2.3.2 Remote Command Execution

Exploit Title: Apache James Server 2.3.2 - Remote Command Execution RCE Authenticated 2 Date: 27/09/2021 Exploit Author: shinris3n Vendor Homepage: http://james.apache.org/server/ Software Link: http://ftp.ps.pl/pub/apache/james/server/apache-james-2.3.2.zip Version: Apache James Server 2.3.2...