EUVD-2026-89347

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery SSRF attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the...

CVE-2026-75926

A flaw was found in Hugo. This vulnerability enables arbitrary command execution by bypassing security restrictions designed to confine asset-processing tools. Because TailwindCSS is granted permission to create child processes by default, an attacker providing a malicious theme, module, or...

EUVD-2026-89332

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone. The...

CVE-2024-10914__POC

CVE-2024-10914 - 概念验证 针对 /cgi-bin/accountmgr.cgi 端点命令注入漏洞的利用程序。该漏洞允许通过未经过滤的参数在受影响系统上执行任意命令。 漏洞描述 CVE-2024-10914 是一个命令注入漏洞，影响具有 CGI Web 接口的设备。易受攻击的应用程序未正确验证 cgiuseradd 请求中的 name 参数，允许攻击者注入系统命令，这些命令将以应用程序的权限执行。 要求 Python 3.7+ requests 库 安装 克隆仓库并安装依赖： git clone...

CVE-2026-100308

A flaw was found in GluonTS. The model loading component fails to safely handle untrusted data during deserialization, which can allow an attacker to execute arbitrary commands with the privileges of the running process. An attacker can exploit this issue by convincing a user or system to load a...

CVE-2024-50379-POC

CVE-2024-50379-POC 此仓库包含一个Python脚本，用于利用CVE-2024-50379 漏洞，该漏洞允许攻击者向易受攻击的服务器上传JSP shell并远程执行任意命令。当目标服务器上的/uploads目录未受保护或缺失时，此利用工具尤为有用。 概述 CVE-2024-50379 是一个影响服务器文件上传处理不当的漏洞，使攻击者能够上传JSP shell。该shell随后可用于远程执行任意命令。提供的Python脚本通过将shell上传到易受攻击的服务器并允许通过命令行界面与服务器交互，自动化了这一过程。 前提条件 在运行脚本之前，请确保已安装以下内容： Python...

gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF

A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main functio...

CVE-2026-100308

The Amazon GluonTS library is vulnerable to arbitrary command execution in versions prior to 0.17.0 . The root cause is the deserialization of untrusted data within the model loading component, which may allow context-dependent attackers to execute OS commands with the privileges of the loading p...

CVE-2023-38646

CVE-2023-38646 Metabase RCE sin autenticación 26/11/2023 Metabase open source anterior a 0.46.6.1 y Metabase Enterprise anterior a 1.46.6.1 permiten a los atacantes ejecutar comandos arbitrarios en el servidor, al nivel de privilegio del servidor. No se requiere autenticación para la explotación...

CVE-2024-10914

CVE-2024-10914 - D-Link 远程代码执行 RCE 漏洞利用 此脚本是针对 CVE-2024-10914 的概念验证 PoC 漏洞利用程序，该漏洞存在于某些 D-Link 设备中。该脚本用于识别并利用易受攻击的设备执行任意命令。 注意： 此脚本仅应用于教育目的或经授权的环境中。未经授权利用此漏洞可能属于非法且不道德的行为。 Finding Targets To find potential targets, use Fofa similar to Shodan.io: Fofa Dork: app="DLink-DNS-ShareCenter" &&...

CVE-2020-11107

CVE-2020-11107 Este es un writeup de la CVE-2020-11107 que he encontrado. Se descubrió un problema en XAMPP anterior a 7.2.29, 7.3.x anterior a 7.3.16 y 7.4.x anterior a 7.4.4 en Windows. Un usuario sin privilegios puede cambiar una configuración de un .exe en xampp-contol.ini para todos los...

CVE-2026-82804 Apache DolphinScheduler: Command Injection in the Alert Script Plugin

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

CVE-2026-82804

The Apache DolphinScheduler (versions before 3.4.3 ) is vulnerable to command injection in the Alert Script plugin . The root cause is the incorporation of the scriptPath parameter into a /bin/sh -c command without sufficient neutralization of shell metacharacters. An authenticated user can explo...

ShellShockHunter

ShellShockHunter v1.0 一个用于测试 Shellshock 漏洞的简单工具 作者: MrCl0wn 博客: http://blog.mrcl0wn.com GitHub: https://github.com/MrCl0wnLab Twitter: https://twitter.com/MrCl0wnLab 邮箱: mrcl0wnlab@\gmail.com Shellshock（软件缺陷） Shellshock（又称 Bashdoor）是 Unix Bash shell 中的一系列安全漏洞家族，第一个漏洞于 2014 年 9 月 24 日披露。Shellshock...

cve_2019-5736-PoC

CVE-2019-5736 PoC Este repositorio contiene un exploit de prueba de concepto basado en C para CVE-2019-5736. Esta vulnerabilidad permite que un contenedor Docker malicioso sobrescriba el binario runc del host y ejecute comandos arbitrarios en el host con privilegios de root, comprometiendo por...

CVE-2024-29973

CVE-2024-29973 GET /cmd,/simZysh/registermain/setCookie?c0=storageextcgi+CGIGetExtStoInfo+None+and+False+or+import"subprocess".checkoutput"id",+shell=True%23 HTTP/1.1 Host: xxxx User-Agent: Mozilla/5.0 X11; Linux x8664; rv:109.0 Gecko/20100101 Firefox/115.0 Accept: / Accept-Language: en-US,en;q=0...

CVE-2023-24489-ShareFile

ShareFile RCE CVE-2023-24489 Este es un script en Python que explota una vulnerabilidad de ejecución remota de código en la aplicación ShareFile CVE-2023-24489. Esta vulnerabilidad permite a un atacante ejecutar comandos arbitrarios en el sistema objetivo. Uso Para usar el script, siga las...

nagios-xi-5.7.5-bugs

nagios-xi-5.7.5-bugs Bugs reported to Nagios XI CVE-2021-25296 Code Location /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php Code snippet if !empty$pluginoutputlen $diskwmicommand .= " --forcetruncateoutput " . $pluginoutputlen; $servicewmicommand .= "...

The vulnerability of the Platypus.js tooling platform, related to deficiencies in the authentication process, allows a violator to execute arbitrary commands.

The vulnerability of the Platypus.js platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2022-1292

CVE-2022-1292 Descripción El script crehash no sanea adecuadamente los metacaracteres del shell para prevenir la inyección de comandos. Este script es distribuido por algunos sistemas operativos de una manera en la que se ejecuta automáticamente. En dichos sistemas operativos, un atacante podría...