41792 matches found
CVE-2026-51190
The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...
EUVD-2026-52482
An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters...
CVE-2026-52102
An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters...
PT-2026-67515
Name of the Vulnerable Software and Affected Versions OpenMediaVault version 8.0.4-1 Description An OS command injection issue exists in the openmediavault-md plugin. This flaw allows attackers to execute arbitrary commands with root privileges by injecting shell metacharacters, which are special...
PT-2026-67418
Name of the Vulnerable Software and Affected Versions luci-app-dockerman LuCI master and openwrt-25.12 snapshots containing the ucode docker rpc.uc RPC backend Description An OS command injection issue exists where the read ACL grants broad ubus access to docker. and docker.container., exposing t...
EUVD-2026-52481
The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...
CVE-2026-51190
The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...
RHEL 10 : mariadb10.11 (RHSA-2026:49522)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49522 advisory. MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation...
Joern 4.0.594
Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...
CVE-2026-51190: Improper Neutralization of Special Elements used in an OS Command
The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...
CVE-2026-52102: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters...
shell-quote npm Code Execution
The vulnerability of the quote function in the shell-quote npm package is related to the lack of data cleansing measures at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
IEC 60870-5-104 Client
Connects to an IEC 104 server and creates an interactive IEC 104 shell session !/usr/bin/env python3 -- coding: utf-8 -- """IEC 60870-5-104 bind listener — opens an IEC 104 session for interrogation.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...
OpenWrt / BusyBox Network Recon
Enumerate interfaces, routes, ARP/neighbors, DNS, and listening sockets on an embedded Linux shell for LAN/WAN pivot planning. !/usr/bin/env python3 -- coding: utf-8 -- """Network / pivot recon for OpenWrt / BusyBox shells.""" from kittysploit import from lib.post.linux.session import...
DNP3 TCP Client
Connects to a DNP3 outstation and creates an interactive DNP3 shell session !/usr/bin/env python3 -- coding: utf-8 -- """DNP3 TCP bind listener — opens a DNP3 session for interactive polling.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...
MIPS BE reverse TCP shell (raw)
MIPS big-endian 32-bit connect-back stager: socket, connect, dup2 x3, execve //bin/sh. Typical on older big-endian routers. Output is raw bytes not a command string. !/usr/bin/env python3 -- coding: utf-8 -- Linux/MIPS BE reverse TCP + dup2 + execve"//bin/sh" — based on public shellcode by rigan...
MIPS LE reverse TCP shell (raw)
MIPS little-endian 32-bit connect-back stager: socket, connect, dup2 x3, execve //bin/sh. Common on OpenWrt/MIPSEL routers. Output is raw bytes not a command string. !/usr/bin/env python3 -- coding: utf-8 -- Linux/MIPS LE reverse TCP + dup2 + execve"//bin/sh" — based on public shellcode by rigan...
Adaptive Reverse TCP Listener
Reverse TCP listener that probes OS on connect and auto-upgrades Unix shells to PTY. Windows stays in line mode. !/usr/bin/env python3 -- coding: utf-8 -- """Adaptive reverse TCP listener. Detects OS on connect, attempts Unix PTY upgrade, stamps session metadata so classicshell / post modules can...
porterminal v1.0.7
Hand a computer to an agent, full control, and watch it. One command, one URL. Also a slick terminal for your own phone. 1. uvx ptn 2. Hand the URL to an AI agent, or scan the QR yourself 3. Watch it work in any browser, and take over anytime !WARNING That complete URL is full access to this...
