AlienVault OSSIM av-centerd RCE (CVE-2014-3804)

Exploits CVE-2014-3804 command injection in the av-centerd updatesysteminfodebianpackage SOAP method. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AlienVault OSSIM av-centerd SOAP RCE CVE-2014-3804 — execute session.""" from future import annotations import r...

PineApp Mail-SeCure test_li_connection RCE

Exploits command injection in PineApp Mail-SeCure via the iptest parameter on /admin/testliconnection.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """PineApp Mail-SeCure testliconnection.php RCE — execute session.""" from future import annotations import re...

Gitlist blame RCE (CVE-2014-4511)

Exploits CVE-2014-4511 command injection in Gitlist blame paths via backtick-wrapped shell metacharacters. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Gitlist blame path command injection RCE CVE-2014-4511 — execute session.""" from future import annotations...

Webmin password_change.cgi RCE (CVE-2019-15107)

Exploits CVE-2019-15107 unauthenticated command injection in the passwordchange.cgi "old" parameter Webmin = 1.920. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Webmin passwordchange.cgi RCE CVE-2019-15107 — execute session.""" from future import annotations...

EditWrxLite - wrx.cgi RCE

Exploits EditWrxLite command injection via the download parameter of wrx.cgi. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """EditWrxLite wrx.cgi command injection RCE — execute session.""" from future import annotations import re from urllib.parse import quote...

Sangfor EDR - slog_client RCE

Exploits unauthenticated command injection in Sangfor EDR 3.2.17R1/3.2.21 via /api/edr/sangforinter/v2/cssp/slogclient JSON params. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor EDR 3.2.17R1/3.2.21 slogclient RCE — execute session.""" from future impor...

VICIdial manager_send.php RCE (CVE-2013-4468)

Exploits CVE-2013-4468 command injection via the extension parameter on /agc/managersend.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """VICIdial managersend.php command injection RCE CVE-2013-4468 — execute session.""" from future import annotations import...

AirLive cgi_test.cgi RCE (CVE-2015-2279)

Exploits CVE-2015-2279 OS command injection in /cgitest.cgi via the writetan parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AirLive cgitest.cgi command injection RCE CVE-2015-2279 — execute session.""" from future import annotations import re from...

D-Link DNS-320/325 - system_mgr.cgi SMS Test RCE

Exploits command injection in cgismstest via the command1 parameter on /cgi-bin/systemmgr.cgi distinct from CVE-2020-25506 NTP injection. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320/325 systemmgr.cgi SMS test RCE — execute session.""" from...

CERIO DT - Save.cgi Command Injection RCE

Exploits command injection in the ip field of /cgi-bin/Save.cgi PING operation on CERIO DT series routers. Requires default operator credentials. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """CERIO DT series router Save.cgi command injection — execute...

WANem result.php RCE (CVE-2012-10041)

Exploits CVE-2012-10041 command injection in WANem result.php via the pc parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """WANem result.php command injection RCE CVE-2012-10041 — execute session.""" from future import annotations import re from...

Apache Spark doAs Command Injection RCE (CVE-2022-33891)

Exploits CVE-2022-33891 command injection in the Spark ACL check when spark.acls.enable is true. Sends a crafted doAs POST parameter to run arbitrary shell commands as the Spark process user. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Spark doAs command injection RCE CVE-2022-33891 —...

CVE-2026-62928

XING CPTrans-ME-X contains an OS Command Injection CWE-78. Unauthenticated OS command may be injected...

CVE-2026-62928

XING CPTrans-ME-X contains an OS Command Injection CWE-78. Unauthenticated OS command may be injected...

EUVD-2026-70916

XING CPTrans-ME-X contains an OS Command Injection CWE-78. Unauthenticated OS command may be injected...

CVE-2026-62928

XING CPTrans-ME-X , a rack accessory product, contains an OS Command Injection vulnerability (CWE-78) that allows unauthenticated attackers to inject arbitrary OS commands. The flaw carries a CVSS 9.8 CRITICAL score (v3.0) with high impact on confidentiality, integrity, and availability, indicati...

EUVD-2026-70815

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAYMOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAYMOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process...

EUVD-2026-70768

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

EUVD-2026-70766

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated...

PT-2026-85565

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...