Seagate BlackArmor NAS - Command Injection

Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the authname parameter to localhost/backupmgmt/preconnectcheck.php. id: CVE-2014-3206 info: name: Seagate BlackArmor NAS - Command Injection author: gy741...

Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun

Netgear RAX43 version 1.0.3.96 contains a command injection and authentication bypass vulnerability. The readycloudcontrol.cgi CGI application is vulnerable to command injection in the name parameter. Additionally, the URL parsing functionality in the cgi-bin endpoint of the router containers a...

CyberPanel - Command Injection

CyberPanel aka Cyber Panel before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner sink. There is /filemanager/upload aka File Manager upload unauthenticated remote code execution via shell metacharacters. id: CVE-2024-51568 info: name: CyberPanel - Comman...

reNgine 2.2.0 - Command Injection

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/wafdetector/?url= string. The commands are executed as root via subprocess.checkoutput. id: CVE-2023-50094 info: name: reNgine 2.2.0 - Command Injection...

Hongdian H8922 3.0.5 - Remote Command Injection

Hongdian H8922 3.0.5 devices are susceptible to remote command injection via shell metacharacters into the ip-address a/k/a Destination field to the tools.cgi ping command, which is accessible with the username guest and password guest. An attacker can execute malware, obtain sensitive informatio...

CVE-2021-36260

CVE-2021-36260 CVE-2021-36260 POC command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands. Exploit Title:...

CVE-2026-13768

CVE-2026-13768 - Gardyn IoT Hub Owner Key Exposure !WARNING This repository contains a fully functional proof-of-concept for a high-severity IoT vulnerability. This code is provided strictly for educational purposes, authorized security research, and defensive testing. Unauthorized use is illegal...

CVE-2026-20245

🚨 CVE-2026-20245 - Cisco Catalyst SD-WAN Manager Privilege Escalation Authenticated Privilege Escalation via Crafted File Upload A vulnerability affecting Cisco Catalyst SD-WAN Manager that allows authenticated attackers with administrative privileges to execute arbitrary commands as root. 📖...

CVE-2024-44623

CVE-2024-44623 In SPX-GC 1.3.0v and below versions, user-controlled input was passed in the exec function of the childprocess module without any sanitization, leading to unauthenticated blind remote code execution. Vulnerability In /routes/routes-api.js, user input received from file param and...

SOC274---Palo-Alto-Networks-PAN-OS-Command-Injection-Vulnerability-Exploitation-CVE-2024-3400-

SOC274---Palo-Alto-Networks-PAN-OS-Command-Injection-Vulnerability-Exploitation-CVE-2024-3400- Introduction CVE‑2024‑3400 is a critical CVSS 10.0 command‑injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN‑OS, first disclosed on April 12, 2024 github.com+10 Investigatio...

social-analyzer

Social Analyzer - API, CLI, and Web App for analyzing & finding a person's profile across +1000 social media \ websites. It includes different analysis and detection modules, and you can choose which modules to use during the investigation process. The detection modules utilize a rating mechanism...

CVE-2026-34910-PoC

CVE-2026-34910 / CVE-2026-34909 — UniFi OS Unauthenticated RCE & File Read Unauthenticated Command Injection RCE CVE-2026-34910 + Path Traversal Arbitrary File Read CVE-2026-34909 in UniFi OS Server. CVSS 10.0 Critical each · CISA KEV listed · actively exploited by a Mirai-derived botnet azsxd...

CVE-2026-58457

CVE-2026-58457 - Unauthenticated OS Command Injection in Shenzhen Aitemi M300 Wi-Fi Repeater !WARNING This code is provided AS IS for educational and research purposes only. Do not use this PoC on production systems, shared environments, or any unauthorized targets. Running or hosting this code m...

CVE-2025-55182-POC

CVE-2025-55182 – Command Injection Vulnerability Scanner Full Proof-of-Concept With Real Command Output This repository contains a Python-based proof-of-concept PoC scanner for CVE-2025-55182, demonstrating how an attacker could exploit a command injection vulnerability through a JSON-based POST...

CVE-2025-27590

CVE-2025-27590 - PoC Exploit Command Injection via Multipart Form Upload 📌 Description This is a Proof-of-Concept PoC exploit for CVE-2025-27590 , a command injection vulnerability affecting web applications that process multipart file uploads without proper sanitization. The vulnerability allows...

Shellshock_vuln_Exploit

🚨 Shellshock RCE Exploit CVE-2014-6271 This is a Python exploit for the Shellshock vulnerability CVE-2014-6271, which affects GNU Bash. The exploit targets CGI scripts on vulnerable web servers and establishes a reverse shell to the attacker's machine. CVE ID CVE-2014-6271 Disclaimer This tool is...

CVE-2026-25089

CVE-2026-25089 - Draft - Fortinet FortiSandbox ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone...

CVE-2018-20162-digi-lr54-restricted-shell-escape

layout: post title: "CVE-2018-20162: Digi TransPort LR54 Restricted Shell Escape" author: sgo category: security The Digi TransPort LR54 is a high speed LTE router commonly used by industry, infrastructure, retail and public transportation. It supports running python scripts in a restricted...

cve-2020-24572

CVE-2020-24572 An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured and virtually unrestricted web console to attack the underlying OS running this software, and execute commands on the system including ones for uploading...

CVE-2025-10035

CVE-2025-10035 Scanner Overview This project provides a tool to scan for systems potentially affected by CVE-2025-10035 , a deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT. The vulnerability may allow an attacker with a validly forged license response signature to...