Lucene search
+L

152978 matches found

Nuclei
Nuclei
added 2026/08/24 5:53 a.m.87 views

sar2html <=3.2.2 Plot Parameter - Remote Code Execution

sar2html version 3.2.2 and prior contains an OS command injection vulnerability in the plot parameter of index.php. A remote, unauthenticated attacker can append shell metacharacters to the plot parameter and execute arbitrary operating system commands. id: CVE-2025-34030 info: name: sar2html...

10CVSS9.1AI score0.60298EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.32 views

Grandstream UCM6200 - SQL Injection

Grandstream UCM6200 series contains an unauthenticated remote SQL injection caused by crafted HTTP requests, letting attackers execute shell commands as root on versions before 1.0.19.20 or inject HTML in emails before 1.0.20.17. id: CVE-2020-5722 info: name: Grandstream UCM6200 - SQL Injection...

10CVSS9.1AI score0.84406EPSS
SaveExploits8References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.153 views

Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account

The command injection vulnerability in the CGI program "remotehelp-cgi" in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST...

9.8CVSS9.1AI score0.89326EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.281 views

Node.js Embedded JavaScript 3.1.6 - Template Injection

Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settingsview optionsoutputFunctionName, which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation. id:...

9.8CVSS7.2AI score0.32808EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.378 views

Hikvision IP ping.php - Command Execution

A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.320201113RELEASEHIK. It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondataip with the input netstat -ano leads to os command injection...

9.8CVSS6.4AI score0.89138EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.32 views

DELMIA Apriso - Command Injection

An Improper Control of Generation of Code code injection / file upload → RCE vulnerability affecting DELMIA Apriso Release 2020 → Release 2025. When an authenticated user can upload files and the upload handler fails to canonicalize filenames or enforce storage restrictions, an attacker may place...

8CVSS6.8AI score0.76148EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.88 views

Altenergy Power Control Software C1.2.5 - Remote Command Injection

Altenergy Power Control Software C1.2.5 is susceptible to remote command injection via shell metacharacters in the index.php/management/settimezone parameter, because of settimezone in models/managementmodel.php. An attacker can potentially obtain sensitive information, modify data, and/or execut...

9.8CVSS8.9AI score0.84752EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.525 views

Gogs <0.12.6 - Remote Command Execution

Gogs before 0.12.6 is susceptible to remote command execution via the uploading repository file in GitHub repository gogs/gogs. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. id...

9.9CVSS9AI score0.65237EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.163 views

Nortek Linear eMerge E3-Series <0.32-08f - Remote Command Injection

Nortek Linear eMerge E3-Series devices before 0.32-08f are susceptible to remote command injection via ReaderNo. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. NOTE: this...

9.8CVSS8.9AI score0.64589EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.49 views

Netgear R6850 V1.1.0.88 - Command Injection

Netgear R6850 router firmware version V1.1.0.88 suffers from a command injection vulnerability in the pingtest functionality. An unauthenticated attacker can inject arbitrary system commands through the c4IPAddr parameter, resulting in remote code execution as root. id: CVE-2024-30568 info: name:...

9.8CVSS6.5AI score0.46918EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.91 views

Issabel Authenticated - Remote Code Execution

A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asteriskcli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be initiated...

9.8CVSS5.3AI score0.58153EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.22 views

WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection

A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection...

9.8CVSS6.7AI score0.09026EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.78 views

D-Link NAS - Command Injection via Name Parameter

A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgiuseradd of the file /cgi-bin/accountmgr.cgi?cmd=cgiuseradd. The manipulation of the argument name leads to os command...

9.8CVSS7.7AI score0.96183EPSS
SaveExploits13References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.127 views

Hongdian H8922 3.0.5 - Remote Command Injection

Hongdian H8922 3.0.5 devices are susceptible to remote command injection via shell metacharacters into the ip-address a/k/a Destination field to the tools.cgi ping command, which is accessible with the username guest and password guest. An attacker can execute malware, obtain sensitive informatio...

9CVSS8.3AI score0.27912EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.76 views

Klog Server <=2.41 - Unauthenticated Command Injection

Klog Server 2.4.1 and prior is susceptible to an unauthenticated command injection vulnerability. The authenticate.php file uses the user HTTP POST parameter in a call to the shellexec PHP function without appropriate input validation, allowing arbitrary command execution as the apache user. The...

10CVSS9.4AI score0.87987EPSS
SaveExploits9References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.94 views

Yachtcontrol Webapplication 1.0 - Remote Command Injection

Yachtcontrol Webapplication 1.0 makes it possible to perform direct operating system commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers...

10CVSS8.8AI score0.58879EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.104 views

Fortinet FortiWLM Unauthenticated Command Injection Vulnerability

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands Successful exploitation of this vulnerability could allow an attacker to...

9.8CVSS8.9AI score0.18148EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.187 views

Telesquare TLR-2005KSH - Remote Command Execution

Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from South Korea's Telesquare company.Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 have an unauthorized remote command execution vulnerability. An attacker can exploit this vulnerability to execute system commands without authorization through...

8.8CVSS7.1AI score0.05848EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.34 views

Web-Check < 2.0.1 Screenshot API - OS Command Injection

Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters. id: CVE-2025-32778 info: name: Web-Check 2.0.1 Screenshot API - OS Command Injection author:...

9.3CVSS5.6AI score0.19326EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.80 views

Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_request

An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur. id: CVE-2025-32813 info: name: Infoblox NetMRI 7.6.1 - Unauthenticated Command Injection in getsamlrequest author: iamnoooob,pdresearch severity: high description: | An issue was discovere...

7.2CVSS7.1AI score0.43894EPSS
SaveExploits0References2
Rows per page
Query Builder