EUVD-2009-5120

Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php script used by its mail subsystem. The vulnerability arises from unsanitized user input passed via a POST request to the data parameter, which is processed by the underlying shell without adequate...

WMIExec

WMIexec Conjunto de scripts de Python que realizan diferentes formas de ejecución de comandos a través del protocolo WMI. Artículo del blog https://whiteknightlabs.com/2023/06/26/navigating-stealthy-wmi-lateral-movement/ Uso wmiexecscheduledjob.py Es un script de Python que se autentica en una...

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager lies in the lack of a mechanism for verifying input data during backup scenarios. This allows a malicious actor to execute arbitrary code with SYSTEM privileges.

The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager is related to deficiencies in the mechanism for verifying input data during backup scenario execution. Exploiting this vulnerability could allow an attacker, operating...

CVE-2019-16278

CVE-2019-16278 CVE-2019-16278Nostromo httpd Command Execution ➜ Downloads python nostromo.py 114.114.114.114 8080 pwd /bin ➜ Downloads python nostromo.py 114.114.114.114 8080 id uid=65534 gid=65534 ➜ Downloads python nostromo.py 114.114.114.114 8080 "ls -al" drwxr-xr-x 2 0 0 0 Apr 12 2013...

CVE-2026-5615

CVE-2026-5615 — VvvebJs Stored Cross-Site Scripting RXSS Overview This repository contains a Python proof-of-concept PoC script demonstrating a Stored Cross-Site Scripting RXSS vulnerability affecting VvvebJs ⚠️ This project is intended strictly for authorized security testing , educational...

SharpWMI

SharpWMI SharpWMI es una implementación en C de varias funcionalidades de WMI. Esto incluye consultas WMI locales/remotas, creación remota de procesos a través de win32process y ejecución remota de VBS arbitrario mediante suscripciones a eventos WMI. También se admiten credenciales alternativas...

CVE-2022-28906-POC

CVE-2022-28906 PoC Python proof of concept for unauthenticated command injection in the TOTOLINK N600R. Vulnerability Product | TOTOLINK N600R ---|--- Firmware | V5.3c.7159B20190425 Type | OS command injection CWE-78 Parameter | langType Endpoint | /cgi-bin/cstecgi.cgi CVSS v3.1 | 9.8 Critical...

cve-2024-51567-poc

cve-2024-51567-poc Simplified Description Vulnerability Overview ID : CVE-2024-51567 Type : Command Injection / CSRF Bypass Affected Versions : CyberPanel 2.3.6 and 2.3.7 unpatched Description : In the upgrademysqlstatus endpoint of CyberPanel, by bypassing the secMiddleware protection for POST...

SharpMove

SharpMove - .NET authenticated execution for remote hosts Building To compile open Visual Studio project and compile for release. Options WMI SCM DCOM Multiple Task Scheduler Service DLL Hijack DCOM Server Hijack Modify Scheduled Task Modify Service binpath SharpMove.exe action=query...

MaccaroniC2

MaccaroniC2 - Potenciando el Comando y Control usando AsyncSSH MaccaroniC2 es un proof-of-concept framework de Comando y Control que utiliza la potente librería Python AsyncSSH, la cual proporciona una implementación asíncrona de cliente y servidor del protocolo SSHv2, y usa el wrapper PyNgrok pa...

gargamel

Gargamel Compilar Compilado y probado con Rust 1.50+. Abra una terminal en el directorio del proyecto y para compilar una versión de lanzamiento escriba cargo build --release La compilación de depuración se puede compilar usando cargo build El ejecutable compilado se encuentra en...

smbexec

smbexec samba 도구를 사용한 신속한 psexec 스타일 공격 최초 개념 및 스크립트: Brav0Hax & PureHate Ruby로 포팅 및 수정: Smilingraccoon과 Zeknox 코드네임 - Machiavellian Metasploit PSExec이 탐지되는 것에 질려서 만들었습니다. 특별히 감사드리는 분은 Carnal0wnage입니다. 그의 블로그가 이 방법을 선택하는 데 영감을 주었습니다...

CVE-2026-93995

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD...

CVE-2026-93995 Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD...

CVE-2026-93995

Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 are vulnerable to improper input validation in the sshd-git component. The GitPgmCommandFactory class allows authenticated SSH clients to execute git commands via the JGit library. Specifically, the previous fix for CVE-2026-58624 wa...

CVE-2026-93995

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD...