CVE-2020-37002 Ajenti 2.1.36 Authenticated Remote Code Execution

Ajenti 2.1.36 contains a post-authenticated remote command execution vulnerability that allows remote attackers to execute arbitrary commands after successful login. Attackers can leverage the /api/terminal/create endpoint to send a netcat reverse shell payload targeting a specified IP and port...

CVE-2020-37002

CVE-2020-37002 — Ajenti 2.1.36 : An authentication bypass vulnerability exists in the web admin panel that allows remote attackers, after successful login, to execute arbitrary commands via the "/api/terminal/create" endpoint. The impact is described as command execution with potential reverse sh...

CVE-2020-37002

Ajenti 2.1.36 contains a post-authenticated remote command execution vulnerability that allows remote attackers to execute arbitrary commands after successful login. Attackers can leverage the /api/terminal/create endpoint to send a netcat reverse shell payload targeting a specified IP and port...

CVE-2020-37002 Ajenti 2.1.36 Authenticated Remote Code Execution

Ajenti 2.1.36 contains a post-authenticated remote command execution vulnerability that allows remote attackers to execute arbitrary commands after successful login. Attackers can leverage the /api/terminal/create endpoint to send a netcat reverse shell payload targeting a specified IP and port...

CVE-2020-37001 Frigate Professional 3.36.0.9 - 'Pack File' Buffer Overflow (SEH Egghunter)

Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the Pack File feature that allows attackers to execute arbitrary code by overflowing the 'Archive To' input field. Attackers can craft a malicious payload that overwrites the Structured Exception Handler SEH and uses ...

CVE-2020-37001

Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the Pack File feature that allows attackers to execute arbitrary code by overflowing the 'Archive To' input field. Attackers can craft a malicious payload that overwrites the Structured Exception Handler SEH and uses ...

CVE-2020-37001 Frigate Professional 3.36.0.9 - 'Pack File' Buffer Overflow (SEH Egghunter)

Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the Pack File feature that allows attackers to execute arbitrary code by overflowing the 'Archive To' input field. Attackers can craft a malicious payload that overwrites the Structured Exception Handler SEH and uses ...

EUVD-2020-30912

Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the Pack File feature that allows attackers to execute arbitrary code by overflowing the 'Archive To' input field. Attackers can craft a malicious payload that overwrites the Structured Exception Handler SEH and uses ...

CVE-2020-37001

CVE-2020-37001 affects Frigate Professional 3.36.0.9. The vulnerability is a local buffer overflow in the Pack File feature that allows an attacker to overflow the 'Archive To' input, overwriting the Structured Exception Handler (SEH) and enabling an egghunter-based payload to execute a reverse s...

Malicious code in mcp-pdftool-plus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e92dea8be02288f271dacad2cd77f1bdd54596da1691cb738c4a7b7b4f77d21 When using the library, the hidden code starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign...

MAL-2026-603 Malicious code in mcp-pdftool-plus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e92dea8be02288f271dacad2cd77f1bdd54596da1691cb738c4a7b7b4f77d21 When using the library, the hidden code starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Hp Power_Manager

CVE-2009-3999 HP Power Manager 4.2 Build 7 exploit inspire...

ROS-20260129-73-0005

A vulnerability in the GNOME Shell graphical shell of the GNOME desktop environment of Linux operating systems is related to the failure to take measures to neutralize a script in attributes on a web page. Exploitation of the vulnerability could allow a remote attacker to execute arbitrary...

PT-2026-5314

Name of the Vulnerable Software and Affected Versions versions prior to 2.3 Description The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When a crafted file is restored, the injected tag is interpreted by a shell, allowing execution of...

EUVD-2025-206519

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

CVE-2020-37012: Improper Neutralization of Special Elements used in an OS Command

Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php endpoint. Attackers can craft a malicious LaTeX payload with shell commands that are executed when processed by the application's tex2png API...

CVE-2025-13905: Incorrect Default Permissions

CWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or more executable service binaries are modified in the installation folder by a local user with normal privilege upon service restart...

PT-2026-5277

Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the Pack File feature that allows attackers to execute arbitrary code by overflowing the 'Archive To' input field. Attackers can craft a malicious payload that overwrites the Structured Exception Handler SEH and uses ...

PT-2026-5287

Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php endpoint. Attackers can craft a malicious LaTeX payload with shell commands that are executed when processed by the application's tex2png API...

Kimi Agent SDK command injection vulnerability

Kimi Agent SDK is a multilingual library developed by Moonshot AI that allows for the integration of Kimi Code agents into applications. Versions of Kimi Agent SDK prior to 0.1.6 contained a command injection vulnerability. This vulnerability stemmed from the development script passing file names...