Lucene search
+L

152980 matches found

Nuclei
Nuclei
added 2026/08/24 5:53 a.m.129 views

MajorDoMo thumb.php - OS Command Injection

MajorDoMo aka Major Domestic Module before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager. id: CVE-2023-50917 info: name: MajorDoMo thumb.php - OS Command Injection author: DhiyaneshDK severity: critical...

9.8CVSS8.9AI score0.38007EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.135 views

Kafka UI 0.7.1 Command Injection

An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/topic/messages. id: CVE-2023-52251 info: name: Kafka UI 0.7.1 Command Injection author: yhy0,iamnoooob severity: high description: | An...

8.8CVSS8.7AI score0.85025EPSS
SaveExploits5References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.153 views

Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account

The command injection vulnerability in the CGI program "remotehelp-cgi" in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST...

9.8CVSS9.1AI score0.89326EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.49 views

Netgear R6850 V1.1.0.88 - Command Injection

Netgear R6850 router firmware version V1.1.0.88 suffers from a command injection vulnerability in the pingtest functionality. An unauthenticated attacker can inject arbitrary system commands through the c4IPAddr parameter, resulting in remote code execution as root. id: CVE-2024-30568 info: name:...

9.8CVSS6.5AI score0.46918EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.91 views

Issabel Authenticated - Remote Code Execution

A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asteriskcli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be initiated...

9.8CVSS5.3AI score0.58153EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.78 views

D-Link NAS - Command Injection via Name Parameter

A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgiuseradd of the file /cgi-bin/accountmgr.cgi?cmd=cgiuseradd. The manipulation of the argument name leads to os command...

9.8CVSS7.7AI score0.96183EPSS
SaveExploits13References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.187 views

Telesquare TLR-2005KSH - Remote Command Execution

Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from South Korea's Telesquare company.Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 have an unauthorized remote command execution vulnerability. An attacker can exploit this vulnerability to execute system commands without authorization through...

8.8CVSS7.1AI score0.05848EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.24 views

HuangDou UTCMS V9 - OS Command Injection

A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection.The attack may be launched remotely. The...

9.8CVSS7AI score0.73338EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.40 views

TotoLink Router setPortForwardRules - Command Injection

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function. id: CVE-2024-24329 info: name: TotoLink Router setPortForwardRules - Command Injection author: pussycat0x severity: critical description...

9.8CVSS8.8AI score0.06172EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.103 views

AVTECH IP Camera - Command Injection

The endpoint /cgi-bin/supervisor/Factory.cgi is vulnerable to command injection via the action parameter, allowing remote code execution. id: CVE-2024-7029 info: name: AVTECH IP Camera - Command Injection author: DhiyaneshDK severity: high description: | The endpoint /cgi-bin/supervisor/Factory.c...

9.8CVSS9.2AI score0.38739EPSS
SaveExploits5References6
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.30 views

AstrBot <= 4.22.1 - Command Injection

AstrBot versions up to and including 4.22.1 contain a command injection vulnerability in the MCP server configuration endpoint. The /api/tools/mcp/add endpoint accepts arbitrary command and args fields that are passed directly to subprocess execution during the connection test, without any...

6.5CVSS6.9AI score0.02304EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.9 views

Pheditor 2.0.1-2.0.3 - OS Command Injection

Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges. id: CVE-2026-48030 info: name: Pheditor 2.0.1-2.0.3 - OS...

9.9CVSS5.8AI score0.05155EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.9 views

Dockwatch <= 0.6.567 - OS Command Injection

Dockwatch through 0.6.567 contains an unauthenticated command injection caused by missing exit after authentication redirect in loader.php and unsanitized input in ajax/compose.php, letting remote attackers execute arbitrary shell commands, exploit requires seeding a session flag via incomplete...

9.8CVSS5.7AI score0.04856EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.9 views

LiteLLM 1.18.10 - Command Injection

LiteLLM 1.18.10 contains a remote code execution caused by lack of validation of arbitrary command and args in MCP server creation, letting attackers execute OS commands remotely, exploit requires crafted JSON configuration. id: CVE-2026-30623 info: name: LiteLLM 1.18.10 - Command Injection autho...

9.8CVSS6.8AI score0.05952EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.6 views

WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read

WGDashboard = 4.2.3 contains a command injection caused by multiple OS command injection points, letting authenticated attackers execute arbitrary commands as root. id: CVE-2026-15733 info: name: WGDashboard = 4.3.2 - Authenticated OS Command Injection /etc/passwd Read author: str4k3r,0xAkoko...

9.8CVSS5.6AI score0.13545EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.107 views

Progress Kemp Flowmon - Command Injection

In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands. id: CVE-2024-2389 info: nam...

10CVSS9AI score0.93037EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.53 views

HTTP File Server <2.3c - Remote Command Execution

HTTP File Server before 2.3c is susceptible to remote command execution. The findMacroMarker function in parserLib.pas allows an attacker to execute arbitrary programs via a %00 sequence in a search action. Therefore, an attacker can obtain sensitive information, modify data, and/or gain full...

10CVSS9.1AI score0.99323EPSS
SaveExploits23References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.321 views

Apache HugeGraph-Server - Remote Command Execution

Apache HugeGraph-Server is an open-source graph database that provides a scalable and high-performance solution for managing and analyzing large-scale graph data. It is commonly used in Java8 and Java11 environments. However, versions prior to 1.3.0 are vulnerable to a remote command execution RC...

9.8CVSS9.3AI score0.9921EPSS
SaveExploits11References6
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.38 views

LG Simple Editor <= v3.21.0 - Command Injection

LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within t...

9.8CVSS9.3AI score0.87649EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.138 views

D-Link NAS - Command Injection via Group Parameter

A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgiuseradd of the file /cgi-bin/accountmgr.cgi?cmd=cgiuseradd. The manipulation of the argument group leads to os command injection. i...

9.8CVSS7.6AI score0.79407EPSS
SaveExploits2References3
Rows per page
Query Builder