CVE-2026-75616

CVE-2026-75616 TP-Link Archer C20 v6 Web 管理界面中存在已认证的 OS 命令注入漏洞。 BPA WAN 配置值未经充分净化便传递给 system，使相邻网络上的已认证管理员能够以 root 身份执行命令。 由 Daniil Gordeev（totekuh）发现并报告。 受影响版本 早于 0.9.1 Build 260811 的 Archer C20 v6 EU 固件 早于 0.9.1 Build 260812 的 Archer C20 v6 US 固件 早于 0.9.1 Build 260812 的 Archer C20 v6 RU 固件 前提条件...

sdwan-cve-2021-1480

CVE-2021-1480 SD-WAN 漏洞利用 用于在 Cico SD-WAN 上利用 CVE-2021-1480 的 PoC 材料。完整报告可在 XMCO 网站上获取： https://blog.xmco.fr/wp-content/uploads/2021/08/XMCO-SDWANReport-CVE-2021-1480.pdf 用法： 1. 更新第 173 行和第 176 行，以设置当前用户的 uid 2. 启动代理：python cve-2021-1480.py -L 4564 127.0.0.1 4565 3. 启动 confdcli：CONFDIPCPORT=4564...

CVE-2026-46368-OpenWrt-Exploit

OpenWrt luci-app-https-dns-proxy 经过身份验证的命令注入（CVE-2026-46368） 本仓库包含针对 luci-app-https-dns-proxy 中关键操作系统命令注入漏洞的概念验证（PoC）利用程序，该漏洞可导致以 root 身份执行任意命令。 CVE ID: CVE-2026-46368 Exploit-DB: EDB-52521 CVSS: 8.8（v3.1）/ 8.7（v4.0）— 高危 CWE: CWE-77（命令中对特殊元素处理不当） 漏洞详情 厂商: OpenWrt 社区包（维护者: mossdef-org / stangri） 产...

CVE-2024-11003-POC

CVE-2024-11003-POC 描述 Qualys发现，在3.8版本之前的needrestart将一个未经过滤的数据传递给一个期望安全输入的库（Modules::ScanDeps）。这可能允许本地攻击者执行任意shell命令。请参见Modules::ScanDeps中相关的CVE-2024-10224。 如果needrestart可以以root权限运行，你就能以root身份执行任意命令。 使用方法 在目标机器上下载exploit.conf并使用命令： sudo needrestart -c exploit.conf...

PcanExploit

CVE-2024-44610: PEAK PCAN-Ethernet Gateway FD DR 認証済みルートエクスプロイト これは何ですか？ このリポジトリには、Peak Ethernetゲートウェイ上でrootとしてコードを実行するProof-of-Concept（PoC）エクスプロイトが含まれています。これを使用するには、Webインターフェースの認証情報を知っている必要があります。 修正方法は？ ベンダーは迅速に修正済みファームウェアを提供しています： PCAN-Gateway FD Software Version 1.3.0 PCAN-Gateway Software...

CVE-2016-5640

CVE-2016-5640 Crestron AirMedia AM-100 RCE CVE-2016-5640 Metasploit 模块 用于利用 Crestron AirMedia AM-100 设备（固件版本 1.4.0.13）无线诊断页面中的远程命令注入漏洞的模块。命令以运行服务的账户身份执行（即通常为 root）。这是我编写的一个旧漏洞利用模块，目的是积累编写检查和使用 cmdstager 的经验。 原始漏洞披露和报告的功劳应归功于...

CVE-2023-26866

CVE-2023-26866 描述 GreenPacket OH736 的 WR-1200 室内单元和 OT-235，固件版本分别为 M-IDU-1.6.0.3V1.1 和 MH-46360-2.0.3-R5-GP，存在远程命令注入漏洞。命令通过登录前执行方式执行，并以 root 权限运行，从而可完全接管设备。该漏洞已由 Lionel Musonza 验证。 漏洞类型 CWE-77 对命令中使用的特殊元素的不当中和（'Command Injection'） CWE 来源接受级别 NIST CWE-94 对代码生成的不当控制（'Code Injection'） 产品供应商...

CVE-2025-67888

CVE-2025-67888 Control Web Panel = 0.9.8.1208 admin/index.php OS 命令注入漏洞 受影响版本： 0.9.8.1208 及更早版本。 漏洞描述： 通过 GET 参数 "key" 传递到 /admin/index.php（当设置 "api" 参数时）的用户输入在用于执行操作系统命令之前未正确过滤。未认证的攻击者可以利用此漏洞注入并执行任意操作系统命令，以 root 用户权限在 Web 服务器上执行。 成功利用此漏洞需要 "Softaculous" 和/或 "SitePad" 已通过脚本管理器安装。 漏洞验证：...

CVE-2026-100714

Froxlor versions up to and including 2.3.10 are vulnerable to command injection due to the lack of restriction or escaping on the system.letsencryptchallengepath setting. The application unescaped concatenates this value into the acme.sh command line within lib/Froxlor/Cron/Http/LetsEncrypt/AcmeS...

CVE-2026-100714 Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no stringregexp or requiredotp guard, and its value is concatenated unescaped into the acme.sh command line built in...

CVE-2026-100714 Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no stringregexp or requiredotp guard, and its value is concatenated unescaped into the acme.sh command line built in...

CVE-2026-93425

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

EUVD-2026-86253

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

CVE-2026-93425: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

DEBIAN-CVE-2026-83603

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socketpath from the low-privileged netdata service account. The account can direct root fail2ban-client...

CVE-2026-83603

The open source observability tool Netdata contains a privilege escalation vulnerability in the setuid-root ndsudo helper command (fail2ban-client-status-socket) located in src/collectors/utils/ndsudo.c. A low-privileged netdata service account can provide a caller-controlled --socket_path to dir...

CVE-2026-80152

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitra...

CVE-2026-80145

Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root ...

CVE-2026-80152 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitra...

CVE-2026-80152

Lantronix SLC8000 (before firmware v9.7.0.3), EMG8500/EMG7500 (before v9.7.0.1), and SLB882/SLCx-03/SLCx-02 (all firmware versions) contain an OS command injection in the set script schedule command, which passes unsanitized user input to a system() call. An authenticated attacker with the servic...