CVE-2021-40113

CVE-2021-40113 Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network PON Series Switches Optical Network Terminal ONT could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the...

litellm-command-injection-security-assessment

CVE-2026-42271 - LiteLLM AI Gateway MCP Command Injection RCE Consultant-Style Cybersecurity Report Professional vulnerability assessment report for LiteLLM command injection risk, including executive summary, technical impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Detail...

Project-Exploitation-of-Webmin-Authentication-Vulnerability

Research Objective: To conduct a comprehensive analysis and successful exploitation of a Remote Code Execution RCE vulnerability in Webmin version 1.890 CVE-2019-15107, ultimately gaining full control over the target system. Methodology: Initial Reconnaissance: Network scanning performed using...

rConfig_rce

rConfig 3.9 Combined SQL Injection and Command Injection PoC Overview This PoC targets rConfig version 3.9.4 and demonstrates exploitation through a combination of SQL Injection and Remote Command Injection vulnerabilities. It automates the process of: 1. Extracting database name via SQLi 2...

CVE-2023-27216_D-Link_DSL-3782_Router_command_injection

This repository does not have a README...

RCE-PoC-CVE-2021-25646

CVE-2021-25646 Proof-of-Concept Go Version Overview This repository contains a proof-of-concept PoC exploit for CVE-2021-25646, a critical remote code execution vulnerability in Apache Druid. The exploit is written in Go and allows for interactive command injection via the terminal. Features...

CVE-2019-19781

CVE-2019-19781 Just a python3 CVE-2019-19781 exploit for Citrix behind a cache. This version accepts '', '|', '2&1'... etc USAGE python3 CVE-2019-19781.py citrix.example.org 'cat /etc/passwd' Todo Repeat if Age header in response. Continuous mode -c. Check mode Get /vpn/../vpns/cfg/smb.conf...

PcanExploit

CVE-2024-44610: PEAK PCAN-Ethernet Gateway FD DR Authenticated Root Exploit What is it? This repository contains a Proof-of-Concept PoC exploit that executed code as root on Peak Ethernet gateways. It requires that you know the credentials to the web interface. How to fix it? The vendor has rapid...

CVE-2024-2997

CVE-2024-2997 Scanner Overview CVE-2024-2997 Scanner is an advanced vulnerability scanner designed to detect the command injection vulnerability in web applications. This tool helps security professionals identify potential security risks in their applications. Disclaimer This tool is for...

CVE-2023-33538-msf

CVE-2023-33538 – TP-Link TL-WR940N/841N Command Injection Metasploit module This Metasploit auxiliary module targets an authenticated command injection vulnerability in TP-Link TL-WR940N V2/V4 and TL-WR841N V8/V10 routers. The issue lies in the vulnerable ssid1 parameter used in WlanNetworkRpm.ht...

CVE-2024-3400

PAN-OS Firewall Exploit Script This script is designed to demonstrate the exploitation of vulnerabilities in PAN-OS firewalls. It sends a specially crafted payload to the firewall's API endpoint to execute arbitrary commands. This exploit specifically targets CVE-2024-3400, a command injection...

CVE-2022-46169

CVE-2022-46169 CVE-2022-46169 Cacti remoteagent.php Unauthenticated Command Injection. This script checks only the conditions of CVE-2022-46169. What is Cacti? Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. ...

Shellbash-CVE-2014-6271

Shellshock Remote Command Injection CVE-2014-6271 中文版本Chinese version Build and run the vulnerable environment： docker-compose build docker-compose up -d When you visit http://your-ip/ you should see two files: safe.cgi victim.cgi safe.cgi generated by the latest version of bash, and victim.cgi i...

CVE-2019-15107

CVE-2019-15107 Programa de prueba para CVE-2019-15107 Esta vulnerabilidad de ejecución remota de comandos en webmin se debe aproximadamente a que qx/…/ en perl provoca la ejecución de comandos. Su explotación requiere ciertas condiciones especiales. Al reproducirla, escribí rápidamente un program...

CVE-2020-13159

CVE-2020-13159 - Artica Proxy before 4.30.000000 Community Edition allows Multiple OS command injection. Product Description: Artica Tech offers a powerful but simple-to-use solution, usually the preserve of Large and Multinational companies. With a starting price of just 99€ and more than 62 000...

CVE-2026-108744

The pbi-cli tool, versions 3.10.1 through 3.12.0 , is vulnerable to an OS command injection within the desktop_sync.py component. The root cause is the passing of unquoted .pbip paths to cmd /c start when reopening projects. An attacker can lure a victim into opening a Power BI project from a spa...

EUVD-2026-96909

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktopsync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim...

CVE-2026-108744 pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktopsync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim...

EUVD-2026-96983

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function processping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about th...

CVE-2026-108576

A critical OS command injection vulnerability exists in TOZED X300 (versions up to 6.01.3 ). The flaw is located within the process_ping function of the IPPingDiagnostics Handler component. An attacker can achieve remote code execution by manipulating the Host argument. The impact is severe, with...