188342 matches found
VulnCheck KEV: CVE-2024-23625
A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root...
vsftpd 2.3.4 Backdoor Command Execution
vsftpd version 2.3.4 contains a backdoor command execution vulnerability. This submission documents identification and impact validation against Metasploitable 2 in an isolated lab...
ALSA-2026:75769 Important: vim security update
Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...
CVE-2026-105691: Improper Neutralization of Special Elements used in an OS Command
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through childprocess.exec. A user who can edit a file can store shell metacharacters...
TencentOS Server 2: sg3_utils (TSSA-2026:1086)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1086 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...
Cisco ASA OS Command Injection (CVE-2020-3167)
A vulnerability in the CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system OS. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabilit...
PT-2026-106232
Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.10.3 langflow-base versions prior to 0.10.3 lfx versions prior to 1.10.3 Description An issue exists in the MCP stdio transport where the software executes commands and arguments provided in an MCP server...
CVE-2026-105697: Improper Neutralization of Special Elements used in an OS Command
Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...
Malicious code in hardhat-ftp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e916c23a0efbd49d3cfcd5993957df7afbade3f454925d0672acc8c9f68245c The package's declared main entry index.js unconditionally requires./lib/config, a 4,499,968-byte obfuscator.io-packed file 26,234-entry string array...
MAL-2026-17510 Malicious code in internallib_v275 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80c1c6d383b3defb01da235e39e08ce56276d887e63d900aea2ee689836f71b4 index.js exports a command function that invokes /bin/bash -c to curl a reverse-shell payload from reverse-shell.sh targeting the hardcoded host...
Malicious code in internallib_v275 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80c1c6d383b3defb01da235e39e08ce56276d887e63d900aea2ee689836f71b4 index.js exports a command function that invokes /bin/bash -c to curl a reverse-shell payload from reverse-shell.sh targeting the hardcoded host...
MAL-2026-17502 Malicious code in botmaker-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86fdc86c67d202ca9938942ef7786534d1b72169187cce13b1cefd8899fa54aa On npm install, postinstall.js collects the installer's hostname, username, current working directory, architecture, platform, and network interface...
Malicious code in botmaker-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86fdc86c67d202ca9938942ef7786534d1b72169187cce13b1cefd8899fa54aa On npm install, postinstall.js collects the installer's hostname, username, current working directory, architecture, platform, and network interface...
CVE-2023-38646
Metabase Pre-Auth RCE POC - CVE-2023-38646 Metabase ओपन सोर्स 0.46.6.1 से पहले और Metabase Enterprise 1.46.6.1 से पहले हमलावरों को सर्वर पर मनमाने कमांड निष्पादित करने की अनुमति देते हैं। मैंने हमलावर की मशीन पर रिवर्स शेल प्राप्त करने के लिए स्क्रिप्ट सीधे लिखी है। उपयोग स्क्रिप्ट को Target URL,...
mwcfg
Estrattore di Configurazione Malware Uno strumento di estrazione di configurazioni malware e moduli per MalDuck Questo progetto è GRATUITO nel senso di GRATIS 🍺, usalo commercialmente, privatamente o come preferisci. Il modo più semplice per usare questo progetto è visitare mwcfg.info e iniziare...
CVE-2026-105134
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack...
EUVD-2026-92078
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack...
CVE-2026-105134 Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack...
CVE-2026-105134 Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack...
CVE-2026-105134
AhsayCBS versions up to 10.3.2 are vulnerable to remote OS command injection in the Replication Receiver component. The flaw exists in the /rps/api/json/UpdateReceivers.do endpoint, where the random argument is improperly neutralized, allowing attackers to execute arbitrary commands remotely. Thi...