193461 matches found
CVE-2026-108161 FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download
FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...
CVE-2026-108161 FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download
FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...
EUVD-2026-96316
FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...
wp2shell-poc
wp2shell PoC Der erste Proof-of-Concept der Pre-Auth-Timing-basierten SQL-Injection-PoC für die WordPress-REST-API-Batch-Route-Konfusionskette CVE-2026-63030 + CVE-2026-60137 Erreichte Befehlsausführung, ohne auch nur zu versuchen, das Admin-Passwort zu knacken. Betroffen: WordPress 6.9.0–6.9.4...
ghidrecomp
Ghidrecomp - Decompilatore Ghidra da riga di comando Informazioni Questo strumento Python da riga di comando decompila tutte le funzioni di un binario e le scrive in una directory in file C separati:mermaid flowchart LR afilename -- bghidrecomp a2Symbol Server -- b b -- eGhidra Project Files b --...
anew
anew Fügt Zeilen von stdin an eine Datei an, aber nur, wenn sie nicht bereits in der Datei vorkommen. Gibt neue Zeilen auch an stdout aus, ähnlich wie ein tee -a, das Duplikate entfernt. Anwendungsbeispiel Hier enthält eine Datei namens things.txt eine Liste von Zahlen. newthings.txt enthält eine...
Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
Anthropic on Friday said it's cutting off live internet access for all its internal evaluations until further notice following the discovery of new incidents in which its artificial intelligence AI models exhibited misaligned behavior and targeted real websites. The AI company said it identified...
cve-2022-36804
CVE-2022-36804: RCE pre-autenticazione in Atlassian Bitbucket Server Una vulnerabilità critica di command injection è stata trovata in molteplici endpoint API di Atlassian Bit bucket Server e Data center. Questa vulnerabilità riguarda tutte le versioni di Bitbucket Server e Data Center rilasciate...
phpsploit
Framework C2 completo che persiste silenziosamente sul webserver tramite una riga di PHP polimorfica Manutenibilità codeclimate Creato da nil0x42 e contributori !https://assets.kitploit.com/production/public/readmes/320/aca304368ddb3...
CVE-2026-101947
ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...
CVE-2026-101947 ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export
ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...
CVE-2026-101947 ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export
ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...
EUVD-2026-96030
ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...
CVE-2026-101947
The ExifTool for photo and video 5.0.1-gms by CellHubs is vulnerable to a Local OS command injection (CWE-78). The flaw exists in the CSV-export path because the application constructs shell command strings from file paths and invokes /system/bin/sh -c without properly escaping embedded single qu...
CVE-2026-101947: Improper Neutralization of Special Elements used in an OS Command
ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...
PT-2026-117880
Security vulnerability affects the n8n package. shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token...
AUTOM8N WHM 82821f7 OS Command Injection
AUTOM8N WHM version through commit 82821f7 contains an OS command injection vulnerability in CGI scripts that pass unsanitized form parameters to shell commands. An authenticated WHM user can inject commands through the user parameter of syncdocroots.cgi...
PT-2026-109664
Name of the Vulnerable Software and Affected Versions cc-connect versions prior to 1.5.1 Description The MAX platform adapter webhook mode in platform/max/max.go fails to require authentication when no webhook secret is configured. Remote attackers can access the webhook listener on port 8080 and...
PT-2026-109657
Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...