CVE-2026-112159 JumpServer Template Rendering os command injection

A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-103038

PingTools Network Utilities 4.64 Free is vulnerable to an OS command injection (CWE-78) within the Watcher ICMP service . The application accepts arbitrary input in the Host field and improperly incorporates it into a command string executed via sh -c . This flaw allows for unauthorized command e...

CVE-2026-103038 PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who...

CVE-2024-10914

CVE-2024-10914 A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgiuseradd of the file /cgi-bin/accountmgr.cgi?cmd=cgiuseradd. The manipulation of the argument name leads t...

CVE-2024-55503

CVE-2024-55503 Termius App MacOS dylib Command injection Description An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLDINSERTLIBRARIES component. using dylib DYLDINSERTLIBRARIES=exploitcombined.dylib...

CVE-2026-94095

Netcore NBR200V2 - Remote Command Injection in Traceroute Diagnostic Feature CVE-2026-94095 Field| Value ---|--- Vendor| Netcore Model| NBR200V2 Firmware Version| V1.3.241127.071246 Affected Component| /usr/bin/networktools Vulnerability Type| OS Command Injection CWE-74 / CWE-77 CVSS 3.1| 9.9...

CVE-2026-19586

CVE-2026-19586 PoC TP-Link Omada SSL VPN Unauthenticated RCE CVE-2026-19586 Overview A command injection vulnerability CWE-78 in the SSL VPN authentication path of TP-Link Omada gateway firmware allows an unauthenticated attacker to execute arbitrary commands as root. When the OpenVPN-based SSL V...

CVE-2025-32375

Setup for the vulnerable version. Start the vulnerable container: docker compose up Create a listener e.g. ncat: ncat -klnv 1337 Run the exploit: python3 exploit.py You should receive an HTTP request in the ncat window with the contents of the OS command id by default if everything worked as...

CVE-2026-10520

CVE-2026-10520 Ivanti Sentry formerly MobileIron Sentry is an enterprise security gateway that proxies traffic between mobile devices and corporate backend resources: email, SharePoint, and internal web applications. It enforces Mobile Device Management MDM policies, terminates encrypted mobile...

HP-HPLIP-Mass-CVE-checker-2026-09-

massexploit — HP HPLIP mass CVE checker 2026-09 Mass check and research exploit driver for HP HPLIP 3.26.6 — CVE-2026-91097 through CVE-2026-91106. CVE| CVSS 4| CWE| Remote ---|---|---|--- CVE-2026-91097| 7.0| CWE-787| yes UI CVE-2026-91098| 8.6| CWE-122| yes UI CVE-2026-91099| 5.1| CWE-61| local...

CVE-2022-33891

CVE-2022-33891 - Apache Spark Command Injection Vulnerability ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author AkbarTrilaksana Description The Apache Spark UI offers the possibility to enable ACLs via the...

CVE-2021-46422

CVE-2021-46422 SDT-CW3B1 South Korean wireless router OS cmd injection PoC Installation git clone https://github.com/ZAxyr/CVE-2021-46422.git cd CVE-2021-46422 pip3 install -r requirements.txt Usage Single URL pocsuite -r pocs/CVE-2021-46422.py -u IP Batch URLs pocsuite -r pocs/CVE-2021-46422.py ...

CVE-2021-40222

CVE-2021-40222 Application : Rittal CMC PU III Web management Devices : CMC PU III 7030.000 Software Revision : V3.11.002 Hardware Revision : V3.00 Attack type : Remote Code Execution Solution : Update to Software Revision V3.17.10 or later Summary : Web application fails to sanitize user input o...

CVE-2020-12124

CVE-2020-12124 An implementation of a proof-of-concept for CVE-2020-12124 https://vulners.com/cve/CVE-2020-12124 The following is an actualization of CVE-2020-12124, a vulnerability which exploits a command injection in the Wavlink WN530H4 router in which certain parameters are taken from URL...

CVE-2026-112263

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2021-3060

CVE-2021-3060 POC/ Exploit Description: An OS command injection vulnerability in the Simple Certificate Enrollment Protocol SCEP feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root us...

CVE-2022-28171-POC

CVE-2022-28171-POC I originally published this on ExploitDB, which you can find at https://www.exploit-db.com/exploits/51607 Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution Date: 16 July 2023 Exploit Author: Thurein Soe CVE : CVE-2022-28171 Reference Link:...

EUVD-2026-104310

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-112263 Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-112263

The Television (tv) application, versions 0.15.0 through 0.15.9 , is vulnerable to OS command injection due to improperly escaped single quotes in the format_command function. An attacker can exploit this by planting a file with a crafted name containing an apostrophe; subsequently, triggering an...