gdog

Gdog A stealthy Python based Windows backdoor that uses Gmail as a command and control server This project was inspired by the gcathttps://github.com/byt3bl33d3r/gcat from byt3bl33d3r. Requirements Python 2.x PyCrypto module WMI module Enum34 module Netifaces module Features Encrypted...

EUVD-2026-79949

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

CVE-2019-9193

EN GenPostgresRCEExploit is a PoC tool designed to exploit an authenticated Remote Code Execution RCE vulnerability in specific versions of PostgreSQL 9.3 - 11.7. It allows authenticated users to execute system commands on a PostgreSQL database server that is vulnerable to CVE-2019-9193. Features...

CVE-2019-9193

EN GenPostgresRCEExploit 是一个 PoC 工具，用于利用特定版本的 PostgreSQL（9.3 - 11.7）中存在的经过身份验证的远程代码执行（RCE）漏洞。它允许经过身份验证的用户在存在 CVE-2019-9193 漏洞的 PostgreSQL 数据库服务器上执行系统命令。 功能特性 RCE 利用 ：通过经过身份验证的 PostgreSQL 会话执行系统命令。 版本检查 ：检查目标 PostgreSQL 服务器的版本，以确认是否存在漏洞。 命令执行 ：允许用户在存在漏洞的服务器上执行命令。 自动表管理 ：自动创建和删除临时表以执行命令，无需手动干预。 依赖要...

freeswitch_rce

version: freeswitchは多くの場合高い権限で実行されるため、特権昇格の効果も達成できます。...

CVE-2024-7954

CVE-2024-7954 This exploit will attempt to execute system commands on SPIP targets CVE-2024-7954. Overview This is a bulk scanning and exploitation tool for CVE-2024-7954: SPIP 4.2.8 allows unauthenticated attackers to launch RCE on SPIP targets. This tool is based on this Security Research. How ...

Web-Check < 2.0.1 Screenshot API - OS Command Injection

Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters. id: CVE-2025-32778 info: name: Web-Check 2.0.1 Screenshot API - OS Command Injection author:...

cve-2019-9978

cve-2019-9978 This is a script that allows exploiting the CVE-2019-9978 vulnerability in a straightforward manner, intended for use in Capture The Flag CTF challenges or as a proof of concept for penetration testing. Prerequisites Python 3 Requests library Install with pip install requests Usage ...

CVE-2025-3248

中文 ｜ English Langflow Vulnerability Scanner A vulnerability scanner for CVE-2025-3248 in Langflow applications. Features Scan single target or multiple targets using FOFA Execute system commands on vulnerable targets Retrieve system information Custom payload support Progress bar for FOFA scannin...

CVE-2021-41773

CVE-2021-41773 - Ejecución Remota de Código en Apache 2.4.49 PoC para CVE-2021-41773 ya que encontré exploits demasiado complicados y este va directo a la Ejecución Remota de Código. Uso Simplemente especifica la dirección IP que ejecuta el servidor vulnerable Apache 2.4.49 con -i y el comando de...

PT-2026-88938

Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potential...

EUVD-2026-68298

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the atta...

CVE-2026-82595

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the atta...

CVE-2026-58115

CVE-2026-58115 affects Siemens SIMATIC IoT2050 Advanced devices (6ES7647-0BA00-1YA2) running Industrial OS with Node-RED. All versions

EUVD-2026-55621

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026...

CVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

CVE-2026-66297 Unescaped deployment environment variables in generated setup commands

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

CVE-2026-71284

The CVE-2026-71284 issue affects Fledge’s backup-restore upload handler (upload_backup) in python/fledge/services/core/api/backup_restore.py. The handler takes the first extracted tar member’s filename and builds a shell command via string formatting: cmd = "cp {} {}". Since only a prefix/suffix ...

CVE-2026-71243

The CVE-2026-71243 entry concerns the backmeup npm package. It vulnerably assembles shell command strings by concatenating option values (name, source, destination, filter) into a single command (e.g., mkdir -p ...; ) and executes via a shell (ssh2-exec or local child_process), instead of using a...

CVE-2026-7693

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the file POST parameter on the restoreBackup AJAX handler. The handler applies escattr — an HTML-context sanitizer that does not strip...