K000163534: Ruby vulnerabilities CVE-2026-42245, CVE-2026-42246, CVE-2026-42257

Security Advisory Description CVE-2026-42245 Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. ...

CVE-2026-105691: Improper Neutralization of Special Elements used in an OS Command

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through childprocess.exec. A user who can edit a file can store shell metacharacters...

PT-2026-106219

Name of the Vulnerable Software and Affected Versions Chainguard Academy edu integrate-platform-docs composite GitHub Action versions from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff through commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 Description Improper neutralization of special element...

CVE-2026-105767: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy edu from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the projectid...

VulnCheck KEV: CVE-2024-23625

A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root...

PT-2026-106212

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description The SVG exporter improperly handles the fill-color value of a text object, inserting it into a ppmcolormask command string that is then executed via child process.exec. An attacker with file editing...

Cisco ASA OS Command Injection (CVE-2021-1476)

A vulnerability in the CLI of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system OS of an affected device. The vulnerability is due to...

Cisco ASA Command Injection (CVE-2021-1488)

A vulnerability in the upgrade process of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to inject commands that could be executed with root privileges on the underlying operating system OS. This...

Cisco ASA OS Command Injection (CVE-2020-3167)

A vulnerability in the CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system OS. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabilit...

CVE-2026-4480

🚨 CVE-2026-4480 - Execução Remota de Código Crítica no Subsistema de Impressão do Samba Execução Remota de Código RCE Vulnerabilidade de Injeção de Comando de Impressão do Samba "Um simples nome de trabalho de impressão nunca deve se tornar um comando de shell." 📖 Visão Geral CVE-2026-4480 é uma...

Samba-CVE-2007-2447-Exploit-Username-Map-Script

Samba CVE-2007-2447 Exploit Script de Mapeamento de Usuário Este repositório contém um script Python projetado para automatizar a exploração da vulnerabilidade CVE-2007-2447 em servidores Samba versões 3.0.20 a 3.0.25rc3. Esta ferramenta foi desenvolvida exclusivamente para fins educacionais e pa...

TOTOLINK_poc

TOTOLINKpoc TOTOLINK A6000R vulnerabilidade de execução de comandos CVE-2024-41319 python TOTOLINKpoc.py -h -. -. OO . OO . /. -. ,-.-'/. -. ,-.-' \ .' / | |OO\ .' / | |OO \ /\ | | \ \ /\ | | \ \ \ | | |/ \ \ | | |/ .' ,| |.' .' ,| |.' / .'. | | / .'. | | '--' '--' --' '--' '--' --' usage:...

CVE-2026-73570

CVE-2026-73570 — Zimbra Collaboration Suite RCE Note: This repository contains an independent technical analysis and PoC reproduction of CVE-2026-73570. It is not the original vulnerability report. Zimbra Collaboration Suite RCE — SMTP log poisoning → swatchdog → OS Command Injection CVSS 8.9, CI...

PoC-CVE-2025-66224

OrangeHRM RCE शोषण - CVE-2025-66224 📋 विवरण यह प्रूफ ऑफ कॉन्सेप्ट PoC OrangeHRM में sendmailpath कॉन्फ़िगरेशन पैरामीटर में कमांड इंजेक्शन के माध्यम से रिमोट कोड एक्ज़ीक्यूशन RCE कमजोरी को प्रदर्शित करता है। शोषण निम्न प्रकार काम करता है: 1. MySQL डेटाबेस hshrconfig तालिका में एक दुर्भावनापूर्ण...

CVE-2024-29973

CVE-2024-29973 - Vulnérabilité d'injection de commandes à distance Description CVE-2024-29973 est une vulnérabilité critique présente dans certains équipements réseau Zyxel. Cette vulnérabilité permet à un attaquant non authentifié d'exécuter des commandes arbitraires sur l'équipement cible en...

CVE-2024-29895.py

Cacti RCE - CVE-2024-29895 Uso: python3 cve-2024-29895.py -u https://target.com/ -c id Afeta versões do Cacti 1.3.X em builds DEV onde cmdrealtime.php está presente e POLLERID está habilitado. Injeção de comando é possível através deste endpoint, fazendo requisição via GET com payload como...

CVE-2026-39808

🚨 FortiSandbox रूट सैंडबॉक्स एस्केप - CVE-2026-39808 🎯 अवलोकन इस रिपॉजिटरी में CVE-2026-39808 के लिए एक साफ और अच्छी तरह से प्रलेखित प्रूफ ऑफ कॉन्सेप्ट PoC शामिल है — जो Fortinet FortiSandbox में एक गंभीर अप्रमाणित कमांड इंजेक्शन भेद्यता है, जो सैंडबॉक्स एस्केप और रूट uid=0 के रूप में रिमोट कोड...

CVE-2026-93958

D-Link R95 BE9500 Wi-Fi 7 स्मार्ट राउटर विक्रेता：D-Link उत्पाद：R95 उत्पाद मॉडल：BE9500 फर्मवेयर संस्करण：1.01B06 भेद्यता प्रकार：प्रमाणित कमांड इंजेक्शन विवरण D-Link R95 BE9500 Wi-Fi 7 स्मार्ट राउटर फर्मवेयर संस्करण BE95001.00.16 में DHMAPI SOAP over HTTPS इंटरफ़ेस में SetTimeSettings अनुरोधों को...

CVE-2026-6837-zyxel-export-cgi-command-injection

CVE-2026-6837: Zyxel export-cgi PKCS12 कमांड इंजेक्शन यह रिपॉजिटरी CVE-2026-6837 के लिए सार्वजनिक राइटअप, त्वरित सत्यापन स्क्रिप्ट और सहायक साक्ष्य प्रस्तुत करती है। यह क्या है CVE-2026-6837 Zyxel के export-cgi हैंडलर में एक पोस्ट-ऑथेंटिकेशन कमांड-इंजेक्शन दोष है। category=pkcs12 शाखा पर, हैंडलर...

CVE-2025-25705

CVE-2025-25705 Description Item: Product Vendor: freebsdbrasil Item: ProApps - Enterprise Appliance Editor Creator: DreamWeaver PHP: PHP Version 7.3.18 Java Script Library: Jquery UI 1.6 | Jquery 1.2.6 Server: NGINX Operational System: FreeBDS Unix Tipo de Vulnerabilidade: Execução Remota de Códi...