EUVD-2026-108610

Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router...

CVE-2026-75775

Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router...

CVE-2026-75775

Certain ASUS routers are vulnerable to an OS command injection vulnerability (CWE-78) due to improper neutralization of special elements used in an OS command. A remote user can execute arbitrary commands with root privileges by sending crafted parameters to the router, specifically when the devi...

LinksysLeaks

LinksysLeaks Python3 script to scan for Linksys smart wifi devices that are vulnerable to CVE-2014-8244 This script was created to help me find vulnerable smart wifi devices that leak sensitive information,known as CVE-2014-8244. You have the option to either scan a single ip or a text file with...

CVE-2022-25581

CVE-2022-25581 Can't find it anywhere on the web, leaving a backup, Python exploit script , used to automate the following steps: ✅ Script Functionality Objectives 1. Log in to the backend obtain csrf and token 2. Construct a malicious request packet to upload a compressed archive containing a...

CVE-2020-5903

CVE-2020-5902 RCE /tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=delete+cli+alias+private+list /tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=create+cli+alias+private+list+command+bash...

inference-gateway-PoC

inference-gateway: security advisory | ---|--- Researcher| Dostxodjayev Abdullox @squeeze440 Advisory| GHSA-5293-fcm6-fh8v CVE| CVE-2026-87009 CVSS 3.1| 5.4 Medium — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L Weakness| CWE-352, CWE-306, CWE-346 Status| Fixed in v0.46.0 Summary : inference-gatew...

CVE-2022-41678

CVE-2022-41678: Dangerous MBeans Accessible via Jolokia API in Apache ActiveMQ By listing and inspecting the MBeans exposed by the Jolokia API at http://127.0.0.1:8161/api/jolokia the following attack vectors have been identified: Arbitrary File Write using Log4J resulting in Remote Code Executio...

CVE-2026-30225-OliveTin-RCE

OliveTin — unauthenticated action execution → RCE + CVE-2026-30225 PoC for privilege escalation / remote code execution against OliveTin instances that run with the shipped guest defaults. Verified against OliveTin 3000.10.0 running as root HTB: Enigma, where it yields an unauthenticated root...

SickChill - Open Redirect

SickChill's login endpoint's 'next' parameter accepts arbitrary content, allowing authenticated attackers to perform open redirects, but this was fixed in commit c7128a8946c3701df95c285810eb75b2de18bf82 by redirecting to a default page. id: CVE-2024-53995 info: name: SickChill - Open Redirect...

Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials

Apache Solr 9.4.0 through 9.10.1 and 10.0.0 contain a hardcoded credentials vulnerability caused by default Basic Authentication template users in bin/solr auth enable, letting remote attackers gain full administrative access. Exploit requires use of default template users. id: CVE-2026-44825 inf...

Glances - Information Disclosure

Glances 4.5.2 contains an information disclosure vulnerability caused by the web server running without authentication by default, letting remote attackers access sensitive system information including credentials, exploit requires no special privileges. id: CVE-2026-32596 info: name: Glances -...

Tattile Camera < 1.181.5 - Default Login

Tattile Smart+, Vega, and Basic device families firmware = 1.181.5 contain a broken authentication caused by default credentials not forced to be changed, letting attackers with management interface access gain administrative privileges. id: CVE-2026-26341 info: name: Tattile Camera 1.181.5 -...

Paperclip - Remote Code Execution

Paperclip 2026.416.0 contains a remote code execution caused by a chain of six unauthenticated API calls in authenticated mode with default configuration, letting unauthenticated attackers execute arbitrary code remotely, exploit requires network access to the target. id: CVE-2026-41679 info: nam...

Brother Printers – Authentication Bypass via Default Admin Password

By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests. id: CVE-2024-51978 info: name: Brother Printers – Authentication...

ZKTeco BioTime <= 9.0.1 - Privilege Escalation

BioTime default employee credentials password 123456 allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files. id: CVE-2023-38952 info: name: ZKTeco BioTime = 9.0.1 - Privilege Escalation author: riteshs4hu severity: high...

Kimai <= 2.57.0 - Default APP_SECRET Authentication Bypass

Kimai Docker images = 2.58.0 which generates a random APPSECRET on first boot. Alternatively, manually set a unique APPSECRET in your .env.local file. reference: - https://github.com/advisories/GHSA-jr9p-4h4j-6c58 - https://github.com/kimai/kimai/releases/tag/2.58.0 classification: cve-id:...

Netsweeper 4.0.5 - Default Weak Account

The Web Panel in Netsweeper before 4.0.5 has a default password of 'branding' for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/. id: CVE-2014-9614 info: name: Netsweeper 4.0.5 - Default Weak Account author: daffainfo severity: critica...

FatPipe WARP/IPVPN/MPVPN - Backdoor Account

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 contain an account named "cmuser" with administrative privileges and no password, letting attackers gain unauthorized admin access, exploit requires no authentication. id: CVE-2021-27856 info: name: FatPipe...

WAPPLES Web Application Firewall <=6.0 - Hardcoded Credentials

WAPPLES Web Application Firewall through 6.0 contains a hardcoded credentials vulnerability. It contains a hardcoded system account accessible via db/wp.no1, as configured in the /opt/penta/wapples/script/wccautoscaling.py file. An attacker can use this account to access system configuration and...