Lucene search
+L

350135 matches found

Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•195 views

Change Detection - Server Side Template Injection

A Server Side Template Injection in changedetection.io caused by usage of unsafe functions of Jinja2 allows Remote Command Execution on the server host. id: CVE-2024-32651 info: name: Change Detection - Server Side Template Injection author: edoardottt severity: critical description: | A Server...

10CVSS8.2AI score0.83601EPSS
SaveExploits5References4
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•543 views

Wing FTP Server <= 7.4.3 - Remote Code Execution

Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution RCE flaw CVE-2025-47812. The vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection into session files. These injected sessio...

10CVSS8.7AI score0.92862EPSS
SaveExploits24References2
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•138 views

MeteoBridge <= 6.1 - Remote Code Execution

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote...

8.8CVSS8.3AI score0.93667EPSS
SaveExploits3References3
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•125 views

Netsweeper <=6.4.3 - Python Code Injection

Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php with certain Referer headers launches a command line with client-supplied parameters, and allows injection of shell metacharacters. id: CVE-2020-13167 info: name: Netsweeper =6.4.4 to mitiga...

9.8CVSS8.7AI score0.95415EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•39 views

Grandstream UCM6200 - SQL Injection

Grandstream UCM6200 series contains an unauthenticated remote SQL injection caused by crafted HTTP requests, letting attackers execute shell commands as root on versions before 1.0.19.20 or inject HTML in emails before 1.0.20.17. id: CVE-2020-5722 info: name: Grandstream UCM6200 - SQL Injection...

10CVSS8.3AI score0.84406EPSS
SaveExploits8References2
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•158 views

Satellian Intellian Aptus Web <= 1.24 - Remote Command Execution

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed. id: CVE-2020-7980 info: name: Satellian Intellian Aptus Web...

10CVSS8.6AI score0.82544EPSS
SaveExploits7References5
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•184 views

Alcatel-Lucent OmniPCX - Remote Command Execution

The OmniPCX web interface has a script "masterCGI" with a remote command execution vulnerability via the "user" parameter. id: CVE-2007-3010 info: name: Alcatel-Lucent OmniPCX - Remote Command Execution author: king-alexander severity: critical description: | The OmniPCX web interface has a scrip...

10CVSS7.5AI score0.97385EPSS
SaveExploits9References5
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•117 views

D-Link DAR-8000-10 - Command Injection

D-Link DAR-8000-10 version has an operating system command injection vulnerability. The vulnerability originates from the parameter id of the file /app/sys1.php which can lead to operating system command injection. id: CVE-2023-4542 info: name: D-Link DAR-8000-10 - Command Injection author:...

9.8CVSS6.8AI score0.84689EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•73 views

Flowise < 3.0.1 - Remote Command Execution

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...

9.8CVSS8.5AI score0.65771EPSS
SaveExploits3References2
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•213 views

SmartNode SN200 Analog Telephone Adapter (ATA) & VoIP Gateway - Command Injection

The SmartNode SN200 Analog Telephone Adapter ATA & VoIP Gateway is vulnerable to command injection. id: CVE-2023-41109 info: name: SmartNode SN200 Analog Telephone Adapter ATA & VoIP Gateway - Command Injection author: princechaddha severity: critical description: | The SmartNode SN200 Analog...

9.8CVSS8.3AI score0.6451EPSS
SaveExploits3References5
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•112 views

cPH2 Charging Station v1.87.0 - OS Command Injection

An OS command injection vulnerability in Hardy Barth cPH2 Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature. id: CVE-2023-46359 info: name: cPH2...

9.8CVSS8.5AI score0.87608EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•132 views

SPIP BigUp Plugin - Remote Code Execution

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. id: CVE-2024-8517 info: name: SPIP BigUp Plugin - Remote Code Execution...

9.8CVSS8.5AI score0.94614EPSS
SaveExploits7References5
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•19 views

SonicWall GMS and Analytics - SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics:...

7.5CVSS7.5AI score0.72579EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•51 views

CyberPanel - Command Injection

CyberPanel contains a command injection vulnerability in the /ftp/getresetstatus and /dns/getresetstatus endpoints.The vulnerability exists due to improper validation of the 'statusfile' parameter, which is directly used in a shell command.The security middleware only validates POST requests,...

10CVSS8.5AI score0.94668EPSS
SaveExploits7References3
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•203 views

NUUO NVR camera `debugging_center_utils_.php` - Command Execution

debuggingcenterutils.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter. id: CVE-2016-5674 info: name: NUUO NVR camera debuggingcenterutils.p...

10CVSS8.8AI score0.9461EPSS
SaveExploits11References2
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•237 views

Seagate BlackArmor NAS - Command Injection

Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the authname parameter to localhost/backupmgmt/preconnectcheck.php. id: CVE-2014-3206 info: name: Seagate BlackArmor NAS - Command Injection author: gy741...

10CVSS8.8AI score0.51014EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•88 views

Apache Tika < 1.1.8 - Header Command Injection

Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. i...

9.3CVSS7.4AI score0.93758EPSS
SaveExploits10References5
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•87 views

F5 BIG-IP Appliance Mode - Command Injection

When running in Appliance mode, an authenticated user assigned the Administrator role may bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. id: CVE-2022-41800 info: name: F5 BIG-IP Appliance Mode - Command Injection author: dwisiswant0 severity: high description...

9.8CVSS8.4AI score0.99954EPSS
SaveExploits69References5
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•119 views

YeaLink DM 3.6.0.20 - Remote Command Injection

Yealink Device Management DM 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. id: CVE-2021-27561 info: name: YeaLink DM 3.6.0.20 - Remote Command Injection author: shifacyclewala,hackergautam severity: critical description: Yealink...

10CVSS8.5AI score0.82865EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/09/23 2:05 a.m.•128 views

pfSense pfBlockerNG <=2.1..4_26 - OS Command Injection

pfSense pfBlockerNG through 2.1.426 is susceptible to OS command injection via root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected. id: CVE-2022-31814 info: name: pfSense pfBlockerNG =2.1..427 to mitigate this vulnerability. reference: -...

9.8CVSS8.2AI score0.91881EPSS
SaveExploits14References5
Rows per page
Query Builder