EUVD-2026-102812

Improper Control of Generation of Code 'Code Injection' vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1...

CVE-2026-94169

The WordPress The Grid plugin (versions

CVE-2026-94169 WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1...

CVE-2026-92115 WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action

The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the value parameter of the update-photo AJAX action. This is due to insufficient shell escaping within the wppaimagemagicka function, where the...

CVE-2026-92115

The WP Photo Album Plus plugin for WordPress (versions up to and including 9.3.02.002 ) is vulnerable to Command Injection via the value parameter of the update-photo AJAX action. The root cause is the lack of escapeshellarg() within the wppa_image_magick_a() function, combined with wppa_decode()...

EUVD-2026-102802

The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the value parameter of the update-photo AJAX action. This is due to insufficient shell escaping within the wppaimagemagicka function, where the...

CVEs

Rhino CVE Proof-of-Concept Exploits A collection of proof-of-concept exploit scripts written by the team at Rhino Security Labs for various CVEs. CVE-2026-46546: Frappe LMS Header Tag Injection Leading to Open Redirect CVE-2026-39405: Frappe LMS Path Traversal in SCORM Package Upload Leading to...

magnolia-rce

Exploit Title: Magnolia DX Core 6.3.8 - Command Injection Date: 05/16/2025 Exploit Author: tmrswrr Version: 6.3.8 Vendor home page: https://docs.magnolia-cms.com/home/ Product: https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.8/ 1. Authenticate as an admi...

CVE-2026-83548-checker

SonicWall SMA 1000 — CVE-2026-83548 / CVE-2026-83549 Exposure Detector A non-intrusive detection script for SonicWall Secure Mobile Access SMA 1000 series appliances affected by CVE-2026-83548 pre-auth SSRF in the Work Place interface, CVSS 10.0 and CVE-2026-83549 post-auth OS command injection i...

CVE-2026-111451

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete...

cve-2022-33891-fix

EP3 - MAC0352 Redes deComputadores e Sistemas Distribuidos 2023 Tópico: CVE-2022-33891 Execução de comandos shell arbitrários em aplicação spark que utiliza autenticação via ACL Alunos Elinilson Vital Leoarndo Bozzetto CVE-2022-33891 Patch Instructions for Ubuntu 22.04 Prerequisites Ubuntu 22.04...

CVE-2025-60787-MotionEye-RCE

CVE-2025-60787: Motioneye Remote Code Execution RCE Professional Proof-of-Concept PoC for CVE-2025-60787, a critical Remote Code Execution RCE vulnerability in MotionEye versions ≤ 0.43.1b4. Technical Overview The vulnerability arises from a client-side validation bypass in the configUiValid...

CVE-2023-30258-Magnus-Billing-v7-Command-Injection-PoC

CVE-2023-30258 — Magnus Billing v7 Command Injection PoC Unauthenticated command injection vulnerability in Magnus Billing v7.3.0. The democ GET parameter in icepay.php is passed directly to a shell function without sanitization, allowing arbitrary command execution as the web server user. The...

CVE-2019-15588

CVE-2019-15588 CVE-2019-15588 Lab: RCE Command Injection Vulnerability Merged into https://github.com/lyy289065406/CVE-2019-5475...

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php. This in turn can lead ...

Apache Airflow <=1.10.10 - Remote Code Execution

Apache Airflow versions 1.10.10 and below are vulnerable to remote code/command injection vulnerabilities in one of the example DAGs shipped with Airflow. This could allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler depending on the executor in us...

D-Link Routers - Remote Command Injection

D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 device may allow an authenticated attacker to execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for...

Apache Kylin 3.0.1 - Command Injection Vulnerability

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation. id: CVE-2020-1956 info: name: Apache Kylin 3.0.1 - Command Injecti...

Altenergy Power Control Software C1.2.5 - Remote Command Injection

Altenergy Power Control Software C1.2.5 is susceptible to remote command injection via shell metacharacters in the index.php/management/settimezone parameter, because of settimezone in models/managementmodel.php. An attacker can potentially obtain sensitive information, modify data, and/or execut...

LG Simple Editor <= v3.21.0 - Command Injection

LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within t...