the-same-key-opens-every-box-cve-2026-71960-hard-coded-jwt-secret-in-cudy-wr3000-mesh-mqtt

CVE-2026-71960 — Hard-coded JWT Secret in Cudy WR3000 2.0 Mesh MQTT Broker PoC tooling for the Hunt-Benito article "The Same Key Opens Every Box: CVE-2026-71960 — Hard-coded JWT Secret in Cudy's WR3000 Mesh MQTT Broker"...

CVE-2021-32158

..| XSStoCommandInjection1 |.. Description : Exploiting a Reflected Cross-Site Scripting XSS attack to get a Command Injection through the Webmin's Upload and Download feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Command Execution eXploit's...

CVE-2025-61299_POC

CVE-2025-61299POC Authenticated Command Injection in Nagios XI 2024R1 CVE-2025-61299...

CVE-2025-32433_PoC

CVE-2025-32433Erlang-OTP This script is a custom security tool designed to test for a critical pre-authentication vulnerability in systems running Erlang-based SSH servers This script is a custom security tool designed to test for a critical pre-authentication vulnerability in systems running...

cve-2020-7247

cve-2020-7247 Exploit Title: OpenSMTPD 6.6.2 - Remote Code Execution. The new Date: 2020-01-29. Exploit Author: 1F98D. Original Author: Qualys Security Advisory. Vendor Homepage: https://www.opensmtpd.org/. Software Link: https://github.com/OpenSMTPD/OpenSMTPD/releases/tag/6.6.1p1. Version:...

CVE-2021-46704-POC

CVE-2021-46704-POC CVE-2021-46704 GenieACS Command Injection POC Affecting genieacs package, versions =1.2.0 1.2.8 How to fix? Upgrade genieacs to version 1.2.8 or higher. Affected versions of this package are vulnerable to Command Injection via the ping host argument lib/ui/api.ts and lib/ping.t...

xerial__sqlite-jdbc_CVE-2023-32697_3-41-2-1

SQLite JDBC Driver SQLite JDBC is a library for accessing and creating SQLite database files in Java. Our SQLiteJDBC library requires no configuration since native libraries for major OSs, including Windows, macOS, Linux etc., are assembled into a single JAR Java Archive file. Usage ➡️ More usage...

CVE-2023-0861-POC

Analyzing and Reproducing the Command Injection Vulnerability CVE-2023-0861 in NetModule Routers NetModule is an Original Equipment Manufacturer OEM of industrial grade routers that are commonly used in critical infrastructure and industrial control systems. On February 24th, 2023, ONEKEY, a...

Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws

Anthropic on Friday said it's cutting off live internet access for all its internal evaluations until further notice following the discovery of new incidents in which its artificial intelligence AI models exhibited misaligned behavior and targeted real websites. The AI company said it identified...

CVE-2023-33782

CVE-2023-33782 Description D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability in the iperf3 diagnostics functionality. Proof of concept...

CVE-2026-25643

Frigate NVR ≤ 0.16.3 Blind RCE Exploit CVE-2026-25643 PoC 📜 Description This Python exploit targets a critical configuration manipulation vulnerability in Frigate NVR versions up to 0.16.3 both authenticated and unauthenticated paths. By injecting a malicious go2rtc stream and a fake camera entry...

ralph

Ralph A working implementation of the Ralph Wiggum autonomous loop technique for Claude Code. Background The official ralph-wiggum plugin in Anthropic's plugin marketplace is currently broken due to a security update in Claude Code v1.0.20 August 2025. The security patch CVE-2025-54795 correctly...

cve-2022-36804

CVE-2022-36804: RCE pre-autenticazione in Atlassian Bitbucket Server Una vulnerabilità critica di command injection è stata trovata in molteplici endpoint API di Atlassian Bit bucket Server e Data center. Questa vulnerabilità riguarda tutte le versioni di Bitbucket Server e Data Center rilasciate...

CVE-2021-36260

CVE-2021-36260 CVE-2021-36260 POC command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands. Exploit Title:...

MAL-004

MAL-004: Command Injection Bypass for CVE-2020-12641 in Roundcube Webmail A bypass was found for "CVE-2020-12641: Command Injection via "imconvertpath" in Roundcube Webmail" affecting versions before 1.4.5, 1.3.12. The php “escapeshellcmd” function, implemented to prevent “CVE-2020-12641: Command...

CVE-2019-19356

Enrutador NETIS WF2419 RCE CVE-2019-19356 Contexto La vulnerabilidad es una Ejecución Remota de Código RCE autenticada como root a través de la página de gestión web del enrutador NETIS WF2419. La vulnerabilidad se ha encontrado en la versión de firmware V1.2.31805 y en la última versión de...

CVE-2023-2636

CVE-2023-2636...

CVE-2023-51385_test

Verify CVE-2023-51385 First, add the following to /.ssh/config 主机 .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Command injection exists in the .gitmodules file statement url = ssh://echo helloworld cve.txtfoo.example.com/bar After configuration is complete, execute the...

CVE-2025-65791

CVE-2025-65791 — Command Injection in ZoneMinder Overview A critical Command Injection vulnerability exists in ZoneMinder v1.36.34 due to improper input validation in the web/views/image.php component. Unsanitized user-controlled input is passed directly to the PHP exec function, allowing remote...

CVE-2025-67511

CVE-2025-67511: Tricking a Security AI Agent Into Pwning Itself Hacktive Security blog post for CVE-2025-67511 Blog Post Link : https://www.hacktivesecurity.com/blog/2025/12/10/cve-2025-67511-tricking-a-security-ai-agent-into-pwning-itself/ TL;DR A command injection vulnerability in the function...