97233 matches found
CVE-2025-29279
CVE-2025-29279 To exploit this vulnerability, the attacker must insert the payload example.com;echo 'testing' into the "Host Address" in Traceroute6 Diagnostics in the Diagnostics section...
lazyweb
LazyWeb - Vulnerable Web Application LazyWeb is a demonstration web application designed to showcase common server-side application vulnerabilities. Each vulnerability is categorized with its respective difficulty rating to provide a comprehensive learning experience for developers and security...
CVE-2026-33050
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands o...
GeoNode has OS command injection via uploaded file layer name
Arbitrary OS commands can be executed on the GeoNode by uploading a vector file with a crafted layer name...
CVE-2026-33050 GeoNode: OS command injection via uploaded file layer name
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands o...
EUVD-2026-118477
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands o...
EUVD-2026-118418
GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the Linux non-server PDF conversion path in grobid-core/src/main/java/org/grobid/core/document/DocumentSource.java passes an attacker-influenced PDF filename through DocumentSource.pdfalto,...
PuttyRider
PuttyRider Hijack Putty sessions in order to sniff conversation and inject Linux commands. Download PuttyRider-bin.zip Documentation Defcamp 2014 presentation - pdf Defcamp 2014 presentation - video Examples List existing Putty processes and their status injected / not injected PuttyRider.exe -l...
CVE-2026-123855
In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs...
CVE-2026-123837
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL...
CVE-2026-122193
OS command injection in the example SSM document provisioning script in Trusted Remote Execution REX before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Ced...
EUVD-2026-118379
OS command injection in the example SSM document provisioning script in Trusted Remote Execution REX before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Ced...
CVE-2026-122193
An OS command injection vulnerability exists in the example SSM document provisioning script within Trusted Remote Execution (REX) prior to 2026-07-28. An authenticated remote user authorized to invoke the Rex-RO or Rex-RW SSM documents may execute arbitrary commands as root on the managed instan...
CVE-2026-122193 OS command injection in the example SSM documents in Trusted Remote Execution (REX)
OS command injection in the example SSM document provisioning script in Trusted Remote Execution REX before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Ced...
Bughound
What is Bughound? Bughound is an open-source static code analysis tool that analyzes your code and sends the results to Elasticsearch and Kibana to get useful insights about the potential vulnerabilities in your code. Bughound has its own Elasticsearch and Kibana Docker image that is preconfigure...
ci_fuzz
Description: This script fuzz's for Command Injection vulnerabilities resulting in remote command execution. Similiar OWASP vulnerablities are explained here -- https://www.owasp.org/index.php/CommandInjection The script will attempt to execute OS commands by injecting into every value in the bod...
commix
English • Ελληνικά • Español • Français • فارسی • Bahasa Indonesia • Türkçe Commix short for command injection exploiter is an open source penetration testing tool, written by Anastasios Stasinopoulos @ancst, that automates the detection and exploitation of command and code injection...
CVE-2026-123855
The JetBrains Toolbox App versions prior to 3.6.1 are vulnerable to a command injection flaw. This vulnerability is triggered through enterprise configuration URLs , where improper neutralization of special elements used in an OS command allows for unauthorized execution. The security metrics ind...