CVE-2024-57376

CVE-2024-57376 Pre-auth remote code execution exploit for D-Link DSR-250 and DSR-250N Security advisory: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10415 Usage $ python3 exploit.py usage: Example $ python3 exploit.py 192.168.1.1 443 id + fingerprint device: DSR-250...

Klog Server <=2.41 - Unauthenticated Command Injection

Klog Server 2.4.1 and prior is susceptible to an unauthenticated command injection vulnerability. The authenticate.php file uses the user HTTP POST parameter in a call to the shellexec PHP function without appropriate input validation, allowing arbitrary command execution as the apache user. The...

CVE-2019-14287-write-up

CVE-2019-14287-write-up 4294967295 Sudo Bug Allows Restricted Users to Run Commands as Root DEMONSTRATION OF VULNERABILITY Add a new user: sudo su - root useradd -m -s /bin/bash testuser passwd testuser // add password to user visudo Add a new entry test ALL=ALL, !root /usr/bin/id // specifying...

CVE-2023-51073

CVE-2023-51073 - Firmware Update Server Verification Vulnerability on Buffalo LS210D Version 1.78-0.03 Christopher J. Pace and Ryan Miller The Buffalo LS210D is a Network Attached Storage NAS server designed and marketed towards small-businesses and individuals. Within the LS210D is the ability t...

CVE-2026-82177

Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance...

EUVD-2026-125343

Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance...

CVE-2026-82177

Dell PowerStore is subject to an OS Command Injection vulnerability (CWE-78). A high-privileged attacker could exploit this flaw to achieve arbitrary root command execution on the appliance. Exploitation details and specific affected versions are not provided in the documents, but the vulnerabili...

CVE-2026-82177

Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance...

CVE-2026-75491

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to an authentication bypass in the Mosquitto plugin auth_plugin_jwt.so . The root cause is the acceptance of unsigned JSON Web Tokens (JWTs) using the alg none algorithm. Attackers possessing any Cudy-trusted client certificate can authentic...

EUVD-2026-125261

Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying a crafted InternetGatewayDevice.User.i.Password value. Attackers can send a SetParameterValues request with shell metacharacters that...

CVE-2026-126953

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to an OS command injection flaw. A malicious or compromised ACS can execute commands as root by sending a SetParameterValues request containing shell metacharacters in the InternetGatewayDevice.User.{i}.Username value. The vulnerability occu...

EUVD-2026-125112

Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying an unvalidated InternetGatewayDevice.User.i.Username value. Attackers can send a SetParameterValues request with shell metacharacters that...

CVE-2020-7247

CVE-2020-7247 This vulnerability exists in OpenBSD’s mail server OpenSMTPD’s “smtpmailaddr” function, and affects OpenBSD version 6.6. This allows an attacker to execute arbitrary shell commands like “sleep 66” as root user How to use? python3 getShell.py If you need a reverse shell then run it...

CVE-2026-96515

CVE-2026-96515: authenticated root command execution in Netlink HG323RW An authenticated limited web user can upload a shell script through the Netlink HG323RW diagnostic import handler and have the UID-0 BOA process execute it. Authentication and valid verification/CSRF values are required; this...

CVE-2026-95675

CVE-2026-95675 — D-Link DAP-1360 RevB Unauthenticated remote root command execution CWE-78 — OS Command Injection in the formSystemCheck handler, reachable via a hardcoded authentication backdoor. Verified against DAP-1360 RevB, firmware 2.14B05. Root Cause Two independent issues chained: 1...

CVE-2026-34990

CVE-2026-34990 Description CVE-2026-34990 - OpenPrinting CUPS versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That token is enough to drive /admin/ requests on...

Grandstream UCM6200 - SQL Injection

Grandstream UCM6200 series contains an unauthenticated remote SQL injection caused by crafted HTTP requests, letting attackers execute shell commands as root on versions before 1.0.19.20 or inject HTML in emails before 1.0.20.17. id: CVE-2020-5722 info: name: Grandstream UCM6200 - SQL Injection...

PT-2026-146862

Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance...

CVE-2024-27130

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ QNAP QTS...

CVE-2025-1974-PoC-exploit

CVE-2025-1974-PoC-exploit Kubernetes Ingress-nginx RCE IngressNightmare ❯ python3 cve-2025-1974-exploit.py http://localhost:8443 "id" ============================================================ CVE-2025-1974 - IngressNightmare Exploit ============================================================...