CVE-2026-107780 Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string an...

CVE-2026-107780 Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string an...

EUVD-2026-95257

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimitlimit = false. Unauthenticated attackers can POST GLUESHELL, GLUEPYTHON, or GLUEPOWERSHELL job...

CVE-2026-106126

A command injection vulnerability exists in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) . This flaw allows an authenticated, low-privileged attacker to execute arbitrary commands with SYSTEM privileges on the PDCe . The root cause is identified as CWE-78 (Improper Neu...

CVE-2026-106126 Command Injection

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure SaaS allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe...

EUVD-2026-95207

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure SaaS allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe...

CVE-2026-73570

CVE-2026-73570 — Zimbra zimbra-snmp Unauthenticated OS Command Injection PoC Proof-of-concept exploit for CVE-2026-73570 , an unauthenticated OS command injection CWE-78, CVSS 8.9 in Zimbra Collaboration Suite Disclaimer: This PoC is intended only for authorized security testing , defensive...

CVE-2025-27636-RCE-in-Apache-Camel

CVE-2025-27636 – Apache Camel RCE Simple Python exploit for the Apache Camel header injection RCE CVE-2025-27636. Usage One-shot command execution ┌──root㉿user-/run/…/user/2024/HTBox/CVE-2025-27636 └─ python3 CVE-2025-27636.py -t http://192.168.159.120 -c "id" Executing: id uid=0root gid=0root...

CVE-2026-69451-PoC

Fastprox EOP PoC for the CVE-2026-69451, blogpost at https://fj016.fr/blog/cve-2026-69451-en Usage fastproxeop.exe --cmd "whoami /all" --out "filename.txt"...

struts2-tool

Struts2 Vulnerability Detection and Exploitation Tool s2tool A pure Java implementation of a Struts2 S2-045 / S2-046 CVE-2017-5638 vulnerability detection and exploitation tool. The detection module covers both the S2-045 / S2-046 vulnerabilities, and the exploitation module provides capabilities...

POC-CVE-2026-0769

Description Proof of concept exploit code for CVE-2026-0769 Usage python3 poc.py -u -c Without bash command proof of code exec via Divide By Zero Error With bash command NOTE: Bash output isn't returned because the endpoint only returns the component template and metadata. The bash output is stor...

POC-CVE-2026-0768

Description Proof of concept exploit code for CVE-2026-0768 Usage python3 poc.py -u -c...

ip-camera-research

IP Camera Research - Fullhan FH8626V100 AJL30PG0803 Security research on a consumer IP camera built on the Fullhan FH8626V100 SoC model AJL30PG0803, resulting in six assigned CVEs covering unauthenticated API access, plaintext credential disclosure, and full unauthenticated device compromise via ...

POC-CVE-2026-5027

Description Proof of concept exploit code for CVE-2026-5027 Usage python3 poc.py -u -c -a "bash command arg File written to Docker container disk...

CVE-2026-84361-poc

CVE-2026-84361: Composer Perforce P4PORT Command Execution PoC Run with Docker Docker Compose provides an isolated image containing vulnerable Composer 2.10.2 and the Perforce p4 client. At runtime it has no network, a read-only root filesystem, no Linux capabilities, and writable tmpfs mounts on...

LAB1-metasploitable

LAB1-metasploitable Exploitation des vulnérabilités sur la version vsftpd 2.3.4 du service ftp CVE-2011-2523 Exploit Title: vsftpd 2.3.4 - Backdoor Command Execution Date: 9-04-2021 Exploit Author: HerculesRD Software Link: http://www.linuxfromscratch.org/thomasp/blfs-book-xsl/server/vsftpd.html...

zyxel-wax650s-research-notebook-public

Zyxel WAX650S Research Notebook Public-safe research notebook for Zyxel WAX650S firmware V7.10ABRM.4C0. This repo is written as a story-format wiki for researchers and future LLM-assisted follow-up work. It captures how the lab was brought up, which findings were confirmed, which chains failed, a...

CVE-2026-75604

CVE-2026-75604 RCE PoC Python proof of concept for CVE-2026-75604, an unauthenticated remote command execution vulnerability in Windows-hosted Next.js applications that use both the Pages Router and App Router without Cache Components. Demonstration Requirements Next.js =13.4 =16.0 16.3.3 Native...

solarview-ics-vulnerability-analysis

SolarView ICS Vulnerability Analysis A cyber-physical threat analysis of the SolarView Compact / Mirai botnet incident, in which attackers exploited CVE-2022-29303 to compromise roughly 800 solar monitoring appliances at Japanese photovoltaic facilities. Course project for ECE 362 — Cyber-Physica...

ditto

ditto Powershell Obfuscator Ditto is a Powershell and JavaScript obfuscator base on tree-sitter-powershell and tree-sitter-javascript. Command Line Usage Basic Command Structure ditto-cli options CLI Arguments & Options Short Option| Long Option| Description ---|---|--- -h| --help| Display help...