SOC274---Palo-Alto-Networks-PAN-OS-Command-Injection-Vulnerability-Exploitation-CVE-2024-3400-

SOC274---Palo-Alto-Networks-PAN-OS-Command-Injection-Vulnerability-Exploitation-CVE-2024-3400- Introduction CVE‑2024‑3400 is a critical CVSS 10.0 command‑injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN‑OS, first disclosed on April 12, 2024 github.com+10 Investigatio...

CVE-2017-5638-ApacheStruts2.3.5

CVE-2017-5638-ApacheStruts2.3.5 A exploit for CVE-2017-5638. This exploit works on versions 2.3.5-2.3.31 and 2.5 – 2.5.10 Requirements optparse, requests Usage This exploit can be used like this: $ python3 CVE-2017-5638ApacheStruts.py -u http://10.129.187.188:8080/Monitoring/example/Welcome.actio...

CVE-2023-36143

CVE-2023-36143 PoC of CVE-2023-36143 - Maxprint Maxlink 1200G v3.4.11E Command Injection Steps to Reproduce: 1. Log in the equipment via your web browser 2. Go to the diagnostic tool 3. Insert any ip, e.g 127.0.0.1, the ; character and a command. 4. Example: 127.0.0.1;cat /etc/passwd...

CVE-2024-44623

CVE-2024-44623 In SPX-GC 1.3.0v and below versions, user-controlled input was passed in the exec function of the childprocess module without any sanitization, leading to unauthenticated blind remote code execution. Vulnerability In /routes/routes-api.js, user input received from file param and...

CVE-2026-108161

FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...

CVE-2026-108546 Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

CVE-2026-108546 Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

EUVD-2026-96341

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

CVE-2026-108546

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

CVE-2026-108546 Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

CVE-2026-108546

Spotweb through version 1.5.8 is vulnerable to an OS command injection vulnerability within the runcommand NZB handler . The root cause is the unescaped substitution of shell metacharacters in a spot title for the $SPOTTITLE variable, which is subsequently passed to the exec() function. Remote at...

EUVD-2026-96316

FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...

CVE-2026-108161

FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...

CVE-2026-108161 FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download

FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...

CVE-2026-108161

FusionPBX versions through 5.6.5 are vulnerable to an OS command injection in the call_recordings::download() function. When the record_name filename template is enabled, unauthenticated attackers can execute commands as the web server user by providing malicious Caller-ID values (e.g., using she...

CVE-2026-108161 FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download

FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...

CVE-2023-0669

CVE-2023-0669 CVE-2023-0669 GoAnywhere MFT command injection vulnerability...

Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws

Anthropic on Friday said it's cutting off live internet access for all its internal evaluations until further notice following the discovery of new incidents in which its artificial intelligence AI models exhibited misaligned behavior and targeted real websites. The AI company said it identified...

cve-2022-36804

CVE-2022-36804: RCE pre-autenticazione in Atlassian Bitbucket Server Una vulnerabilità critica di command injection è stata trovata in molteplici endpoint API di Atlassian Bit bucket Server e Data center. Questa vulnerabilità riguarda tutte le versioni di Bitbucket Server e Data Center rilasciate...

CVE-2026-101947

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...