186840 matches found
CVE-2025-70518
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...
CVE-2019-9193-Home-Lab
CVE-2019-9193 — PostgreSQL COPY FROM PROGRAM RCE 本实验室模拟 CVE-2019-9193 ，这是一个 PostgreSQL 9.3–11.2 版本中的漏洞，允许： COPY ... FROM PROGRAM '' 当超级用户或拥有 pgexecuteserverprogram 角色的用户执行时，可以运行操作系统命令。 你的任务是利用此功能读取： /tmp/flag.txt 目标 1. 连接到 PostgreSQL： 用户：postgres 密码：sentinel7 主机端口：5433 2. 使用 COPY FROM PROGRAM ：...
CVE-2026-35196
CVE-2026-35196 · Chamilo LMS · 操作系统命令注入 → RCE 研究人员： K 披露类型： 负责任披露 状态： 已修复 受影响产品： Chamilo LMS 2.0（已在 v1.11.32 上确认） 📋 漏洞摘要 字段| 详情 ---|--- 产品| Chamilo LMS 受影响版本| 2.0（已在 v1.11.32 上确认） 漏洞类型| 操作系统命令注入 CWE| CWE-78 — 对操作系统命令中特殊元素的中和不当 CVSSv3.1 评分| 8.8（高危） 向量| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H...
CVE-2026-106510
The Backstage open framework for developer portals is vulnerable to remote code execution in versions prior to 1.14.6 . The flaw exists in the @backstage/plugin-techdocs-node package, where an authenticated user capable of registering catalog entities can provide a crafted mkdocs.yml file. This i...
CVE-2026-106510 Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdownextensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted...
CVE-2026-107202 CVE-2026-107202
A command injection vulnerability exists in the h-ui version v0.0.25 and below administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule...
CVE-2026-107202 CVE-2026-107202
A command injection vulnerability exists in the h-ui version v0.0.25 and below administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule...
EUVD-2026-94361
A command injection vulnerability exists in the h-ui version v0.0.25 and below administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule...
CVE-2026-107202
The h-ui administrative API (version v0.0.25 and below ) is vulnerable to a command injection flaw due to improper validation of the listen configuration field . An authenticated administrator can submit values containing shell metacharacters, which the application then processes using fmt.Sprint...
CVE-2026-107202 CVE-2026-107202
A command injection vulnerability exists in the h-ui version v0.0.25 and below administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule...
Exploit for OS Command Injection in Ivanti Standalone_Sentry
CVE-2026-10520-...
ChamiloLMS-CVE-2023-4220
ChamiloLMS CVE-2023-4220 漏洞利用工具 Python 漏洞利用脚本，针对 CVE-2023-4220 ，这是一个影响 Chamilo LMS = 1.11.24 的未经认证的任意文件上传漏洞。 该漏洞位于 Chamilo 的 BigUpload 组件中。在易受攻击的安装中，上传处理程序允许在没有适当验证的情况下上传 PHP 文件。由于上传的文件存储在 Web 可访问的目录中，如果启用了 PHP 执行，上传的 PHP 文件可以直接被请求并用作 webshell。 此仓库包含两个版本的漏洞利用脚本： chamilocve20234220auto.py...
cups: cups: argument injection in mailto notifier via notify-recipient-uri
An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot b...
CVE-2025-7775-vulnerable-lab
CVE-2025-7775 Vulnerable Lab 本仓库提供了一个易受攻击的环境，用于测试针对CVE-2025-7775的nuclei模板。 运行 docker build -t vuln-app . docker run -d --name vuln-test -p 5000:5000 vuln-app 漏洞测试 1. 远程命令执行 RCE curl -X POST http://localhost:5000/api/v1/configuration \ -H "Content-Type: application/json" \ -d '"payload":"ls...
CVE-2026-102256
Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS...
USN-8895-1: Sudo vulnerability
It was discovered that Sudo did not properly handle time-based access restrictions when sudoers rules used NOTBEFORE or NOTAFTER with timestamps omitting the trailing timezone indicator. A local attacker could possibly use this issue to execute commands outside the intended time window by...
CVE-2026-23744
CVE-2026-23744 — MCPJam Inspector 未授权 RCE CVE-2026-23744 的未授权远程代码执行 PoC。MCPJam Inspector 1.4.2 及更早版本通过 /api/mcp/connect 暴露了相关功能，可在无需认证的情况下启动由攻击者控制的 MCP 服务器命令。 仅限授权测试和研究使用。请勿将其用于你不拥有或未经明确许可进行测试的系统。 功能说明 HTTP POST - /api/mcp/connect - serverConfig command - process launch - command execution 1...
CVE-2026-102256
A post-authentication OS Command Injection vulnerability (CWE-78) exists in the SonicWall SMA1000 appliance . This flaw allows a remote authenticated attacker with administrator privileges to execute arbitrary OS commands under specific conditions, leading to remote code execution (RCE). The vuln...
CVE-2026-102256
Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS...
CVE-2026-102256
Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS...