EUVD-2026-114133

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool...

CVE-2026-119288

The build automation system Zuke is vulnerable to OS Command Injection in versions prior to 1.51.0 on Windows platforms. The root cause is that @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, which causes cmd.exe to re-parse command lines assembled using C-runtime q...

CVE-2026-119288 Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool...

CVE-2021-41730

TENDA Authorization Remote Command Execution Exploit Author: SHENGXI [email protected] Vender: TENDA CVE-2021-41730 - /bin/httpd Firmware version: AC15: =USAC15V1.0BRV15.03.05.20multiTDE01.bin AC6: USAC6V1.0BRV15.03.05.16multiTD01.bin ....... Hardware Link:...

Cisco-UCS-Manager-2.2-1d-Remote-Command-Execution

Cisco-UCS-Manager-2.2-1d-Remote-Command-Execution - Cisco Bug: CSCur90888 Exploit Title : Cisco UCS Manager - 2.21d - Remote Command Execution Description : An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System UCS Manager before 2.24b,...

CVE-2026-119287 Zuke: Command-form registry descriptors bypass the MCP launch policy

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...

CVE-2026-119287 Zuke: Command-form registry descriptors bypass the MCP launch policy

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...

CVE-2026-119287

The Zuke build automation system for Deno (versions prior to 1.51.0 ) contains a vulnerability in the @zuke/core MCP registry mode. The system fails to apply the ZUKE_REGISTRY_LAUNCH_HOSTS authorization when processing command-form registry descriptors. If a run-capable caller invokes a tool from...

EUVD-2026-114132

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...

CVE-2017-1000117

CVE-2017-1000117 How it works? $ git clone --recursive [email protected]:ikmski/CVE-2017-1000117.git How to create this repository $ cat message.txt | gzip | base64 command $ git submodule add [email protected]:ikmski/Hello-World.git subs/CVE-2017-1000117 $ cat .gitmodules submodule...

slmail-exploit

These Python scripts are for educational purposes only! ⚫ Example of use: python exploit.py 192.168.0.100 ip victm DO NOT FORGET TO OPEN THE DOOR IN YOUR MACHINE...

CVE-2022-1388

CVE-2022-1388 Impact This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. There is no data plane exposure; this is a...

CVE-2024-3400-

PAN-OS Firewall Command Injection Vulnerability This repository contains a Go script that exploits a Command Injection vulnerability in firewalls running Palo Alto Networks' PAN-OS operating system. The vulnerability, identified as CVE-2024-3400, allows an unauthenticated attacker to execute...

CVE-2017-11882-exp

CVE-2017-11882 43b original script from https://github.com/embedi/CVE-2017-11882 109b original script from https://github.com/unamer/CVE-2017-11882/ salute, now unamer's code can execute shellcode CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE...

CVE-2026-119146

A flaw was found in ProFTPD. A remote, potentially unauthenticated attacker can trigger a buffer overflow in the modrewrite module by sending File Transfer Protocol FTP command arguments that exceed the internal buffer length. Successful exploitation corrupts session memory and terminates the...

EUVD-2026-114093

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdu...

CVE-2026-118238 CVE-2026-118238

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdu...

CVE-2026-118238 CVE-2026-118238

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdu...

CVE-2026-118238

The Tenda W18E High-Power AP is vulnerable to OS command injection in its web management server (/bin/httpd) via the diagnose packet-capture feature. The vulnerability occurs because the formSetNetCheckTools function fails to validate shell metacharacters in the protocol and targetDevice JSON fie...

CVE-2026-119586

A flaw was found in the SQLite command-line interface. This vulnerability allows an attacker to achieve arbitrary command execution by convincing a user to run the recovery command on a specially crafted database. Because the recovery process fails to sanitize embedded shell instructions within t...