Wavestore VMS venusd /simple/export command injection RCE

Authenticated venusd /simple/export user=install$cmd runs as root via command substitution default creds install:a on port 8443 plain HTTP. """Wavestore VMS venusd /simple/export command injection root.""" from future import annotations import base64 import re import socket import ssl from...

Opengear NGCS PDU name command injection

Administrator POST /api/v2/pdus with injected pdu.name breaks out of ogpower -n quoting; io.popen runs attacker command as root. !/usr/bin/env python3 -- coding: utf-8 -- """Opengear NGCS PDU name field command injection authenticated root.""" from future import annotations import json import re...

MultiTech Conduit import_config filename command injection RCE

Authenticated POST /api/command/uploadconfig with malicious filename breaks out of importconfig shell quoting. """MultiTech Conduit AEP importconfig filename command injection root RCE.""" from future import annotations import json from kittysploit import from lib.protocols.http.httpclient import...

TRENDnet TV-IP302PI NTP address command injection RCE

Authenticated CGI/ONVIF SetNTP: msntp -r sink with semicolon/command substitution in NtpIP / hostname field. """TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Server Address Reaching Root Execution Through a Shell-Form system Call CWE-78""" from future import annotations from types...

RCDevs WebADM 2.4.14 - OS Command Injection in the Log Viewer `sid` Parameter (C — Detect

Fingerprint / reachability check for RCDevs WebADM 2.4.14 - OS Command Injection in the Log Viewer sid Parameter CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for RCDevs WebADM 2.4.14 - OS Command Injection in the Log Viewer sid Parameter CWE-78""" from kittysploit import from...

MultiTech Conduit AEP — Authenticated Command Injection in `import_config` → Roo — Detect

Fingerprint / reachability check for MultiTech Conduit AEP — Authenticated Command Injection in importconfig → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for MultiTech Conduit AEP — Authenticated Command Injection in importconfig → Root RCE""" from kittysploit import from...

Cambium cnMatrix SSL CSR command injection root RCE

Authenticated admin session; COMMONNAME field injected as ";CMD;echo " executed during CSR generation. """Cambium cnMatrix SSL CSR COMMONNAME command injection root RCE.""" from future import annotations import re from urllib.parse import urlencode, unquote from kittysploit import from...

Minuteman UPS system_param.csp unauth command injection

Unauthenticated POST /systemparam.csp with malicious WanIPAddr breaks out of ifconfig eth0 … netmask … system call. !/usr/bin/env python3 -- coding: utf-8 -- """Minuteman UPS NMC systemparam.csp WanIPAddr command injection.""" from future import annotations import re from urllib.parse import...

IPConfigure Orchid VMS — Authenticated Command Injection in the DNF Repository G — Detect

Fingerprint / reachability check for IPConfigure Orchid VMS — Authenticated Command Injection in the DNF Repository GPG-Key Import Path root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for IPConfigure Orchid VMS — Authenticated Command Injection in the DNF Repository GPG-Key Import...

GeoVision SNMPv3 authKey injection root RCE

LAPI Digest admin: szAuthKey injected into net-snmp-config system sink classic '; cmd ; ' on TBL4700. """GeoVision GV-TBL4700 — SNMPv3 User Config → net-snmp-config Command Injection → Root RCE""" from future import annotations import json from kittysploit import from lib.protocols.http.httpclien...

Parasoft CTP deserialization restore path JSP RCE

Anonymous POST database/restore;welcome with malicious backup.zip deserializes gadget chain writing JSP under webapp images; GET executes. """Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT - Unfiltered Java Deserialization in the Database Restore Path Behind a Raw-URI License Gate Bypass an...

Lantronix EDS3000PR — Authenticated Command Injection in FsUnmount → Root RCE — Detect

Fingerprint / reachability check for Lantronix EDS3000PR — Authenticated Command Injection in FsUnmount → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Lantronix EDS3000PR — Authenticated Command Injection in FsUnmount → Root RCE""" from kittysploit import from...

Loadbalancer.org ADC Deployment Template Command Injection to Root RCE — Detect

Fingerprint / reachability check for Loadbalancer.org ADC Deployment Template Command Injection to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Loadbalancer.org ADC Deployment Template Command Injection to Root RCE""" from kittysploit import from lib.protocols.http.httpclie...

Minuteman UPS NMC — Unauthenticated Command Injection in system_param.csp → Root — Detect

Fingerprint / reachability check for Minuteman UPS NMC — Unauthenticated Command Injection in systemparam.csp → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Minuteman UPS NMC — Unauthenticated Command Injection in systemparam.csp → Root RCE""" from kittysploit import from...

OSNexus QuantaStor — alertConfigSet smtpPassword Command Injection → Root RCE — Detect

Fingerprint / reachability check for OSNexus QuantaStor — alertConfigSet smtpPassword Command Injection → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for OSNexus QuantaStor — alertConfigSet smtpPassword Command Injection → Root RCE""" from kittysploit import from...

Wavestore VMS venusd /simple/export Command Injection to Root RCE — Detect

Fingerprint / reachability check for Wavestore VMS venusd /simple/export Command Injection to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Wavestore VMS venusd /simple/export Command Injection to Root RCE""" from kittysploit import from lib.protocols.http.httpclient import...

Teltonika RutOS ipsec status logread injection — Detect

Fingerprint RutOS VuCI web UI and ipsec/openvpn API surface for authenticated logread command-injection advisory. !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Teltonika RutOS ipsec status logread command injection.""" from kittysploit import from lib.protocols.http.httpclient import...

DrayTek Vigor uploadlangs command injection root RCE

Authenticated language pack upload: filename passes cgiEscape only & then systemmv ... with ; injection. !/usr/bin/env python3 -- coding: utf-8 -- """DrayTek Vigor uploadlangs filename command injection root RCE.""" from future import annotations import uuid from kittysploit import from...

Edimax BR-6478AC setWAN command injection root RCE

HTTP Basic auth POST /goform/setWAN — pppUserName/pptpUserName/L2TPUserName injected into system pipeline as root boa User root. """Edimax BR-6478AC setWAN authenticated command injection root.""" from future import annotations import base64 from urllib.parse import urlencode from kittysploit...

CVE-2026-94346

PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Path Traversal vulnerability. A high...