CVE-2026-24061

CVE-2026-24061-PoC ⚠ This tool is created solely for educational use only. Unauthorized use outside of controlled environments is strictly prohibited. CVE-2026-24061 is a critical vulnerability CVSS 9.8 in telnetd from GNU Inetutils versions 1.9.3–2.7 that allows a remote attacker to bypass...

Webmin_1.890-POC

Webmin 1.890 expired Remote Root CVE-2019-15107 Webmin version 1.890 was released with a backdoor that could allow anyone with knowledge of it to execute commands as root. Versions 1.900 to 1.920 also contained a backdoor using similar code, but it was not exploitable in a default Webmin install...

CVE-2026-24061

-c0392b?style=flat GNU InetUtils telnetd - Unauthenticated Remote Root via NEW-ENVIRON Variable Injection Overview - Technical Analysis - Affected Versions - Usage - Remediation - References Vulnerability Overview CVE-2026-24061 is a critical authentication bypass vulnerability in the telnetd...

CVE-2026-24061---telnetd

CVE-2026-24061 – telnetd 🔥 Description CVE-2026-24061 is a critical vulnerability affecting certain implementations of telnetd , allowing an authentication bypass and the obtainment of a remote root shell without valid credentials. This repository provides a Proof of Concept PoC for detecting...

CVE-2017-7494

CVE-2017-7494 针对SAMBA CVE-2017-7494漏洞的远程root利用工具。 详细信息 本利用工具分为两部分： 首先，它编译一个名为"implant.c"的有效载荷，并生成一个库（libimplantx32.so或libimplantx64.so），该库切换为root用户，脱离父进程并派生一个反向Shell。 其次，它在目标主机上查找可写共享，以上传该库（使用随机名称）并尝试加载它。 只要目标存在漏洞，且有效载荷与目标操作系统及架构匹配，该利用工具就100%可靠。 使用方法 在你的机器上运行以下命令： root@kitploit: $ nc -p 31337 -l...

CVE-2022-34753-EXPLOIT

CVE-2022-34753 - SpaceLogic C-Bus Home Controller 中的 OS 命令注入 CVE-2022-34753 是一个严重的安全漏洞，归类为 CWE-78，表明“对 OS 命令中使用的特殊元素的不当中和”（通常称为 'OS 命令注入'）。此漏洞构成重大风险，因为如果受影响的命令被攻破，可能导致远程 root 利用。 受影响的产品 此漏洞影响以下产品： root@kitploit: 产品名称：SpaceLogic C-Bus Home Controller 5200WHC2 原名：C-Bus Wiser Home Controller MK2...

CVE-2026-24061-Telnetd

CVE-2026-24061 GNU Inetutils Telnetd Authentication Bypass CVE: CVE-2026-24061 Severity: Critical CVSS: 9.8 Critical CWE: CWE-88 — Improper Neutralization of Argument Delimiters in a Command Affected Component: GNU Inetutils telnetd Affected Versions: 1.9.3 through 2.7 Overview CVE-2026-24061 is ...

vsFTP-2.3.4-Remote-Root-Shell-Exploit

vsFTP 2.3.4 Remote Root Shell Exploit A Simple Python Program that uses gets a Remote Root Shell on the Target Device by exploiting a Vulnerability CVE-2011-2523 present in vsFTP 2.3.4 Requirements Language Used = Python3 Modules/Packages used: socket os pexpect paramiko getpass datetime optparse...

oxasploits

oxasploits A number of exploits written by oxagast Most of these CVEs are accreddited to oxagast as well Contact: Marshall Whittaker [email protected] CVEs and PoC code CVE-2006-3392 Webmin =1.29 remote root exploit This exploit, lifts a Webmin cookie with a directory transversal and aritrar...

Exploit for Argument Injection in Gnu Inetutils

CVE-2026-24061 — GNU Inetutils Telnetd Authentication Bypass...

CVE-2026-73519 WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...

CVE-2026-71985

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute...

CVE-2026-71985 MSI Radix AXE6600 v781521 Command Injection via accesscontrol Function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute...

CVE-2026-71951

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEIvalue field, resulting in command execution wit...

CVE-2026-71952

D-Link DWR-M961 devices with hardware version C1 and firmware before 1.1.5_C1_202607071108 are vulnerable to a command injection via the /boafrm/formPinManageSetup interface. An attacker can inject commands into the oldPIN field, causing root-level execution. Remediation: upgrade to firmware 1.1....

Exploit for Use After Free in Exim

CVE-2026-45185 — Dead.Letter: Exim Heap UAF to Remote Root...

CVE-2025-29296

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The...

Exploit for CVE-2026-58457

CVE-2026-58457 - Unauthenticated OS Command Injection in Shenz...

CVE-2026-15428 OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with...

CVE-2026-53479

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command...