CVE-2018-7600-Drupal-POC-EXP

+----------------------------------------------------------------------+ DES: by zhzyker as https://github.com/zhzyker/exphub + Drupal Drupalgeddon 2 원격 코드 실행 CVE-2018-7600 + +----------------------------------------------------------------------+ USE: python3 + EXP: python3 cve-2018-7600cmd.py...

CVE-2026-91097-CVE-2026-91106

🔬 最新の脆弱性リサーチとエクスプロイトリリースについてはTelegramに参加してください HPLIP Printer Application — 認証不要の管理者乗っ取り HPLIP Printer Application （PAPPLベースのWebインターフェース）の3.26.6より前 のすべてのバージョンを対象とした大量エクスプロイトツール。このツールは、PAPPL Webインターフェースのデフォルトの認証不要状態...

CVE-2022-33891

CVE-2022-33891 - Apache Spark 명령 주입 취약점 ⚠️ 교육 및 승인된 보안 연구 목적으로만 사용하세요 원본 익스플로잇 작성자 원본 PoC 작성자 AkbarTrilaksana께 깊은 감사를 드립니다. 설명 Apache Spark UI는 구성 옵션 spark.acls.enable을 통해 ACL을 활성화할 수 있는 기능을 제공합니다. 인증 필터와 함께 사용하면 사용자가 애플리케이션을 보거나 수정할 수 있는 접근 권한이 있는지 확인합니다. ACL이 활성화된 경우 HttpSecurityFilter의 코드 경로를 통...

CVE-2022-3552

CVE-2022-3552 BoxBlilling의 취약점을 악용하기 위해서는 버전이 "BoxBilling=4.22.1.5"여야 하며 유효한 관리자 자격 증명 이 필요합니다. 위의 조건을 충족한다면, RCE를 얻기 위해 다음 단계를 따라야 합니다. 파이썬 가상 환경을 생성하세요 Linux python3 -m venv .venv source .venv/bin/activate 이제 pwntools 라이브러리를 설치하세요 pip3 install pwntools 종속성 누락에 대한 오류가 발생하면 일부 시스템 패키지를 설치해야 할 수도...

CVE-2026-100580 OpenClaw before 2026.7.1 Remote Code Execution via cron tool

OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...

Astra Linux – Vulnerability in Vim

Vim is an open-source, command-line text editor. Prior to version 9.2.0073, there was a vulnerability related to OS command injection in the netrw standard plugin bundled with Vim. By forcing a user to open a specially crafted URL e.g., using the scp:// protocol handler, an attacker could execute...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.65 and earlier, with Server Side Includes SSI enabled and modcgid but not modcgi, pass the shell-escaped query string to the exec cmd="..." directives. This issue affects Apache HTTP Server versions prior to 2.4.66. Users are recommended to upgrade to version 2.4.66, which...

CVE-2026-85979

Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...

CVE-2026-85979

Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...

UBUNTU-CVE-2026-85979

Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...

EUVD-2026-76124

Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the javakeystorepasswd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is...

CVE-2026-85979 Command Injection in Puppet Enterprise

Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...

CVE-2026-85979: Improper Neutralization of Special Elements used in an OS Command

Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...

EUVD-2026-72869

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

PT-2026-87130

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

PT-2026-88277

Name of the Vulnerable Software and Affected Versions Roo-Code versions prior to 3.54.1 Description A flaw in the shell command parsing logic allows the bypass of auto-approve restrictions. The issue stems from the omission of the bash pipe operator from the command parser's operator token set. A...

CVE-2026-19843

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...

CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

GHSA-GX45-XRJ5-G6C4 CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

CVE-2026-85674

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...