Ivanti Connect Secure Command Injection (CVE-2024-21887)

Chains CVE-2023-46805 path traversal auth bypass with CVE-2024-21887 command injection via /api/v1/totp/user-backup-code/../../admin/config/set on Ivanti Connect Secure / Policy Secure gateways. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Connect Secure auth bypass + command injection...

Palo Alto GlobalProtect Command Injection (CVE-2024-3400)

Exploits CVE-2024-3400 in PAN-OS GlobalProtect: SESSID path traversal writes into devicetelemetry cron directories, yielding root command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Palo Alto GlobalProtect PAN-OS command injection CVE-2024-3400.""" import secrets import time from...

D-Link DAR-8000 Command Injection (CVE-2023-4542)

Exploits CVE-2023-4542 in D-Link DAR-8000-10: OS command injection via the id parameter of /app/sys1.php. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAR-8000 sys1.php command injection CVE-2023-4542.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...

D-Link DNS-320 login_mgr RCE (CVE-2019-16057)

Exploits CVE-2019-16057 in D-Link DNS-320 str: inj = urllib.parse.quotef'80|cmd', safe='' p...

D-Link Router Sip Parameter RCE (CVE-2018-10823)

Exploits CVE-2018-10823 in D-Link DWR routers: command injection via the Sip parameter on chkisg.htm. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link router chkisg.htm command injection CVE-2018-10823.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclient...

DrayTek Router RCE (CVE-2020-8515)

Exploits CVE-2020-8515 in DrayTek Vigor routers: unauthenticated command injection via keyPath in /cgi-bin/mainfunction.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """DrayTek mainfunction.cgi command injection CVE-2020-8515.""" import re from kittysploit import from lib.protocols.http.httpclie...

Telesquare TLR-2005KSH RCE (CVE-2024-29269)

Exploits CVE-2024-29269 in Telesquare TLR-2005KSH LTE routers: unauthenticated command injection via Cmd parameter in sysCommand. !/usr/bin/env python3 -- coding: utf-8 -- """Telesquare TLR-2005KSH command injection CVE-2024-29269.""" import re import urllib.parse from kittysploit import from...

Zyxel NAS remote_help RCE (CVE-2024-29972)

Exploits CVE-2024-29972 in Zyxel NAS326/NAS542: unauthenticated command injection in remotehelp-cgi NsaRescueAngel backdoor path yields root command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS remotehelp-cgi command injection CVE-2024-29972.""" import re import urllib.parse...

Progress LoadMaster Command Injection (CVE-2026-8037)

Exploits CVE-2026-8037 unauthenticated OS command injection in Progress ADC LoadMaster /accessv2 JSON API via malformed g0-g15 fields WatchTowr pattern. !/usr/bin/env python3 -- coding: utf-8 -- """Progress Kemp LoadMaster pre-auth command injection CVE-2026-8037.""" import json import re from...

Honeywell PM43 Printer RCE (CVE-2023-3710)

Exploits CVE-2023-3710 in Honeywell PM43 printers: newline injection in the username field of loadfile.lp login executes OS commands. !/usr/bin/env python3 -- coding: utf-8 -- """Honeywell PM43 loadfile command injection CVE-2023-3710.""" import re from kittysploit import from...

Yachtcontrol systemcall RCE (CVE-2019-17270)

Exploits CVE-2019-17270 in Yachtcontrol webapplication 1.0: unauthenticated OS command injection via /pages/systemcall.php?command=. !/usr/bin/env python3 -- coding: utf-8 -- """Yachtcontrol systemcall.php command injection CVE-2019-17270.""" import re import urllib.parse from kittysploit import...

Zyxel NAS weblogin RCE (CVE-2020-9054)

Exploits CVE-2020-9054 in Zyxel NAS firmware 5.21: pre-auth command injection via the username parameter of /cgi-bin/weblogin.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS weblogin.cgi command injection CVE-2020-9054.""" import re import urllib.parse from kittysploit import from...

Yealink DM Command Injection RCE (CVE-2021-27561)

Exploits CVE-2021-27561 in Yealink Device Management 3.6.0.20: unauthenticated command injection via /sm/api/v1/firewall/zone/services zone parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Yealink DM firewall zone command injection CVE-2021-27561.""" import re import urllib.parse from...

NETGEAR DGN syscmd RCE (CVE-2024-12847)

Exploits CVE-2024-12847 in NETGEAR DGN routers: unauthenticated command injection via setup.cgi todo=syscmd&cmd= parameter. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR DGN setup.cgi syscmd RCE CVE-2024-12847.""" import re import urllib.parse from kittysploit import from...

Exploit for CVE-2026-105134

CVE-2026-105134-style OS Command Injection Lab A minimal, sel...

Astra Linux – Vulnerability in Python 3.7, Python 2.7

In Python aka CPython, up to version 3.10.8, the mailcap module does not add escape characters to commands found in the system’s mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input if those commands lack validation of...

Astra Linux – Vulnerability in OpenSSH

In SSH in OpenSSH before version 9.6, OS command injection could occur if a user name or host name contained shell metacharacters, and this name was referenced by an expansion token in certain situations. For example, a untrusted Git repository might contain a submodule with shell metacharacters ...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26, and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command method. This method constructs shell commands by interpolating user-supplied Perforce connection parameters port, user, client...

Astra Linux – Vulnerability in Vim

Vim is an open-source, command-line text editor. Prior to version 9.2.0435, there was a vulnerability related to OS command injection in Vim’s :find command-line completion mechanism. When the path option contained shell commands enclosed in backticks, those commands would be executed during file...

Astra Linux – Vulnerability in Vim

Vim is an open-source, command-line text editor. Prior to version 9.2.0073, there was a vulnerability related to OS command injection in the netrw standard plugin bundled with Vim. By forcing a user to open a specially crafted URL e.g., using the scp:// protocol handler, an attacker could execute...