Test IT testing system Command Execution

The vulnerability of the Test IT testing system relates to the use of externally controlled input data for class selection. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Platypus.js Auth Bypass Command Execution

The vulnerability of the Platypus.js platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2024-10914__POC

CVE-2024-10914 - Proof of Concept Exploit for command injection vulnerability in the /cgi-bin/accountmgr.cgi endpoint. This vulnerability allows arbitrary command execution on the affected system through unsanitized parameters. Vulnerability Description CVE-2024-10914 is a command injection...

ShellShockHunter

ShellShockHunter v1.0 It's a simple tool for test vulnerability shellshock Autor: MrCl0wn Blog: http://blog.mrcl0wn.com GitHub: https://github.com/MrCl0wnLab Twitter: https://twitter.com/MrCl0wnLab Email: mrcl0wnlab@\gmail.com Shellshock software bug Shellshock, also known as Bashdoor, is a famil...

CVE-2021-3317

Information Exploit Title: Klog Server 2.4.1 - Command Injection Authenticated Date: 26.01.2021 Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.klogserver.com/ Version: 2.4.1 Description: https://docs.unsafe-inline.com/0day/klog-server-authenticated-command-injection CVE:...

CVE-2020-5902

🚨 CVE-2020-5902 — F5 BIG-IP TMUI RCE CVE-2020-5902 is a critical unauthenticated Remote Code Execution RCE vulnerability in the F5 BIG-IP Traffic Management User Interface TMUI / Configuration utility. 📌 Overview Disclosed by F5 on June 30, 2020 NVD published July 1, 2020, this flaw allowed...

CVE-2015-3224

CVE-2015-3224 Ruby-On-Rails Web Console RCE What is this? This is a metasploit module for Metasploit. I already have this module. Yes, this is packaged into metasploit. But with that module you can't get arbitrary command execution. I mean, you can only establish reverse/bind shell payloads with...

EUVD-2026-118782

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands t...

CVE-2021-3129

CVE-2021-3129 Laravel Ignition RCE Exploit This is a Python exploit script for CVE-2021-3129, a remote code execution vulnerability in Laravel when the Ignition package is installed. This vulnerability allows an attacker to execute arbitrary system commands via PHAR deserialization. Features...

PT-2026-139146

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 10.0.8.0 through 10.0.8.12 IBM API Connect versions 12.1.0.0 through 12.1.1.2 Description Remote authenticated attackers can execute arbitrary commands on the underlying host due to OS command injection. This occurs...

CVE-2014-6271

EXPLOIT FOR CVE-2014-6271 USAGE : CVE-2014-6271.py full path to target uri command...

LXD has argument injection in backup compression algorithm leading to AFW and ACE

Reported from https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 Summary Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrar...

CVE-2026-123357

GROBID , a machine learning software for extracting information from scholarly documents, is vulnerable to OS command injection in versions prior to 0.9.1 . The vulnerability exists in the Linux non-server PDF conversion path, specifically within grobid-core/src/main/java/org/grobid/core/document...

git-clean-filter

This is a documented known issue, but I found this during my research & its pretty useful for RT/PT. Summary: The filter..clean directive in .git/config points at a script and .gitattributes binds that filter to a tracked file. Whenever git renders a real git diff of that file it runs the worktre...

CVE-2026-116533

The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host...

EUVD-2026-117900

The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host...

CVE-2026-122157

A flaw was found in Yank Note. The terminal handler fails to properly sanitize input during permission checks, resulting in an operating system command injection vulnerability. A remote attacker could exploit this flaw by submitting specially crafted input, allowing arbitrary command execution on...

CVE-2026-34157

A flaw was found in Wails. The framework's origin validation logic converts wildcard patterns into overly permissive regular expressions, allowing lookalike web origins to bypass access controls when partial or trailing wildcards are configured. A remote attacker controlling a matching domain can...

CVE-2026-121751

A flaw was found in Node Version Manager nvm. Remote version data retrieved from a mirror is stored without sufficient validation and later evaluated during shell arithmetic operations. An attacker controlling a malicious or compromised mirror can provide crafted version strings that trigger...

CVE-2026-113663

The AG2 open-source AgentOS contains a vulnerability in SandboxShellTool configurations (versions 0.13.2 until 1.1.1; autogen 0.13.2 to 0.14.1) when using allowed=[...] or readonly=True. The ShellAdapter._filter and contains_shell_operator functions in ag2/tools/sandbox/filter.py and ag2/tools/sa...