Billion 5200W-T - Remote Command Injection

Unauthenticated or authenticated OS command injection in Billion 5200W-T via advremotelog.asp or toolstime.asp. Spawns utelnetd and opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Billion 5200W-T remote command injection — opens framework shell session.""" from...

Grandstream GXV3611 HD - Telnet SQL Injection

SQL injection in the Grandstream GXV3611 HD telnet login resets the admin password to 'a', triggers the !/ port lol backdoor on TCP/20000, then opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Grandstream GXV3611 HD telnet SQLi — opens framework shell session.""" impo...

MVPower DVR Jaws RCE

Module exploits MVPower DVR Jaws RCE vulnerability through 'shell' resource.Successful exploitation allows remote unauthorized attacker to execute commands on operating system level. Vulnerablity was actively used by IoT Reaper botnet. !/usr/bin/env python3 -- coding: utf-8 -- """MVPower DVR Jaws...

Grandstream GXV3611 HD - Telnet Backdoor

Triggers the hidden Grandstream GXV3611 HD telnet backdoor !/ port lol which starts a root shell on TCP/20000, then opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Grandstream GXV3611 HD telnet backdoor trigger — opens framework shell session.""" import time from...

D-Link DWR-932B - UDP Backdoor (HELODBG)

Sends the HELODBG UDP packet to enable the hidden telnet service on D-Link DWR-932B devices, then opens a framework shell session as root. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR-932B UDP HELODBG backdoor — opens framework shell session.""" from future import annotations import...

Malicious code in setup-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957e8b8d535ccc5e5d7e84e99a51695f7a50a4417bfca5f3582ae2817ca75846 The package's lib/report.js requires childprocess, fs, https, and os at the top of the module and constructs an HTTPS POST to a hardcoded destination...

Malicious code in system-performance-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f382b23398f0b2550e29a61c444b8dbd45796d20c938dead6ada9d967d82cabc Package advertises itself as a system performance monitoring helper, but its package.json declares a postinstall hook node install.js that opens a TC...

MAL-2026-14194 Malicious code in system-performance-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f382b23398f0b2550e29a61c444b8dbd45796d20c938dead6ada9d967d82cabc Package advertises itself as a system performance monitoring helper, but its package.json declares a postinstall hook node install.js that opens a TC...

PT-2026-78363

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software fails to sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or within an extracted archive using a name that contains a single quote followed by shel...

PT-2026-78364

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software fails to sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or within an extracted archive. If the filename contains a single quote...

CVE-2026-43961: Improper Control of Generation of Code

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

CVE-2026-63187: Improper Control of Generation of Code

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...

CVE-2026-68560: Improper Neutralization of Special Elements used in an OS Command

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...

CVE-2026-65611: Improper Neutralization of Special Elements used in an OS Command

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

CVE-2026-76228: Improper Neutralization of Special Elements used in an OS Command

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

CVE-2026-65612: Improper Neutralization of Special Elements used in an OS Command

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...

CVE-2026-16875: Improper Neutralization of Special Elements used in an OS Command

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to shell metacharacter injection...

PT-2026-78645

Name of the Vulnerable Software and Affected Versions Logto versions 1.40.1 through 1.40.9 Description In the .github/workflows/commitlint.yml file, the github.event.pull request.title variable is directly interpolated into an inline echo command. A pull request title containing a single quote ca...

Improving LLM-Based SSH Honeypots through Prompting and Fine-Tuning

LLM-based SSH honeypots often use closed cloud LLMs because they give strong shell realism, but cloud models create deployment problems. These include no stable versioning, provider-side changes, attacker-driven cost, and model decommissioning. Local open-weight models avoid these problems, but...

PT-2026-78624

Name of the Vulnerable Software and Affected Versions IBM AIX version 7.2 IBM AIX version 7.3 IBM PowerVM VIOS version 4.1 Description A shell metacharacter injection flaw allows a local attacker to execute arbitrary commands on the system. Recommendations At the moment, there is no information...