CVE-2024-53376

CVE-2024-53376 CyberPanel Authenticated OS Command Injection Affected Devices CyberPanel versions 2.3.8 are vulnerable to an OS command injection. To exploit the vulnerability the attacker is required to firstly login to the webpanel. Tested With CyberPanel 2.3.7 Technical details An attacker can...

CVE-2022-1292

CVE-2022-1292 POC Description The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary comman...

CVE-2023-34152

CVE-2023-34152 RCE vulnerability affecting ImageMagick 6.9.6-4. This vulnerability allows the attacker to execute commands on the victim system. Thus, allowing for Remote Command Execution. This is a POC which was inspired by fullwaywang discovery of CVE-2023-34152. Vulnerability Disclosure Usage...

CVE-2019-0232-EXP

CVE-2019-0232-EXP Test environment: Win10 Home 1809, jre version 18.3 build 10.0.2+13, Tomcat version 9.0.13. Affected Tomcat Versions ★Apache Tomcat 9.0.0.M1 to 9.0.17 ★Apache Tomcat 8.5.0 to 8.5.39 ★Apache Tomcat 7.0.0 to 7.0.93 Configuration conf/web.xml cgi...

MeteoBridge <= 6.1 - Remote Code Execution

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote...

Cacti cmd_realtime.php - Command Injection

Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when registerargcargv option of PHP is On. In cmdrealtime.php line 119, the $pollerid used ...

CVE-2020-8515

CVE-2020-8515 Draytek CVE-2020-8515 PoC I had kicking about. Amusingly, the command injected gets executed twice, see here: $ ./draytek.py draytek.local executing command: cat /etc/passwd + vulnerable! executing command: uname -a Linux Vigor3900 2.6.33.5 1 Wed Mar 28 00:49:28 CST 2018 armv6l...

ci_fuzz

Description: This script fuzz's for Command Injection vulnerabilities resulting in remote command execution. Similiar OWASP vulnerablities are explained here -- https://www.owasp.org/index.php/CommandInjection The script will attempt to execute OS commands by injecting into every value in the bod...

CVE-2020-15778-SCP-Command-Injection-Check

CVE-2020-15778 – OpenSSH SCP Command Injection Vulnerability Detection Script About CVE-2020-15778 is a command injection vulnerability discovered in the scp utility provided by OpenSSH versions ≤ 8.3p1. The issue allows an attacker to execute arbitrary commands on the client system if a crafted...

CVE-2026-108983

The GV-ASManager Web Server is vulnerable to a Command Injection vulnerability (CWE-78) within the GeoWebServer.exe process, specifically on the default connection ports. This flaw allows for the improper neutralization of special elements used in OS commands. The vulnerability is rated as CRITIC...

CVE-2026-108983 GV-ASManager Web Server Command Injection Vulnerability

A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe...

CVE-2020-7384

CVE-2020-7384 This is a small exploit in bash which I had made while solving one of the boxes from Hack The Box. The exploit is modified from the original exploit here: https://github.com/justinsteven/advisories/blob/master/2020metasploitmsfvenomapktemplatecmdi.md Usage dos2unix CVE-2020-7384.sh...

VMware-CVE-2022-22954-Command-Injector

VMware-CVE-2022-22954-Command-Injector Proof of Concept for exploiting VMware CVE-2022-22954 How it works This simple Python script makes a GET request to the specified URL appended with /catalog-portal/ui/oauth/verify?error=&deviceUdid= and then followed by a URL encoded version of this string:...

CVE-2026-39808

CVE-2026-39808 On November 2025, a critical vulnerability was discovered on Fortinet's FortiSandbox which allowed an unauthenticated attacker to execute commands in the underlying OS as root. The vulnerability was patched and finally made public on April 2026. This vulnerability affects...

NetMRI-2014-3418

NetMRI-CVE-2014-3418 - Metasploit Module InfoBlox Network Automation OS Command Injection Metasploit Module Product: Network Automation NetMRI Switch Port Manager Automation Change Manager Security Device Controller Vendor: InfoBlox Vulnerable Versions: 6.4.X.X-6.8.4.X Tested Version: 6.8.2.11 CV...

PT-2026-117484

A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been...

PT-2026-117682

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub 416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor wa...

Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

ALSA-2026:84594 Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

ALSA-2026:84591 Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...