25252 matches found
EUVD-2026-108610
Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router...
CVE-2026-75775
Certain ASUS routers are vulnerable to an OS command injection vulnerability (CWE-78) due to improper neutralization of special elements used in an OS command. A remote user can execute arbitrary commands with root privileges by sending crafted parameters to the router, specifically when the devi...
CVE-2026-75775
Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router...
LinksysLeaks
LinksysLeaks Python3 script to scan for Linksys smart wifi devices that are vulnerable to CVE-2014-8244 This script was created to help me find vulnerable smart wifi devices that leak sensitive information,known as CVE-2014-8244. You have the option to either scan a single ip or a text file with...
CVE-2022-25581
CVE-2022-25581 Can't find it anywhere on the web, leaving a backup, Python exploit script , used to automate the following steps: β Script Functionality Objectives 1. Log in to the backend obtain csrf and token 2. Construct a malicious request packet to upload a compressed archive containing a...
CVE-2020-5903
CVE-2020-5902 RCE /tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=delete+cli+alias+private+list /tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=create+cli+alias+private+list+command+bash...
inference-gateway-PoC
inference-gateway: security advisory | ---|--- Researcher| Dostxodjayev Abdullox @squeeze440 Advisory| GHSA-5293-fcm6-fh8v CVE| CVE-2026-87009 CVSS 3.1| 5.4 Medium β CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L Weakness| CWE-352, CWE-306, CWE-346 Status| Fixed in v0.46.0 Summary : inference-gatew...
CVE-2022-41678
CVE-2022-41678: Dangerous MBeans Accessible via Jolokia API in Apache ActiveMQ By listing and inspecting the MBeans exposed by the Jolokia API at http://127.0.0.1:8161/api/jolokia the following attack vectors have been identified: Arbitrary File Write using Log4J resulting in Remote Code Executio...
CVE-2026-30225-OliveTin-RCE
OliveTin β unauthenticated action execution β RCE + CVE-2026-30225 PoC for privilege escalation / remote code execution against OliveTin instances that run with the shipped guest defaults. Verified against OliveTin 3000.10.0 running as root HTB: Enigma, where it yields an unauthenticated root...
Jfrog Artifactory <6.17.0 - Default Admin Password
Jfrog Artifactory prior to 6.17.0 uses default passwords such as "password" for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. id: CVE-2019-17444 info: name: Jfrog Artifactory...
Netsweeper 4.0.5 - Default Weak Account
The Web Panel in Netsweeper before 4.0.5 has a default password of 'branding' for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/. id: CVE-2014-9614 info: name: Netsweeper 4.0.5 - Default Weak Account author: daffainfo severity: critica...
CVE-2024-56071
π¨ Simple Dashboard = 2.0 - Unauthenticated Privilege Escalation π Description The Simple Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to elevate their privileges to that of an...
frevvomapexec
frevvomapexec frevvomapexec is a script to verify the existence of a blind SQL injection vulnerability by injecting a delay of your choosing in seconds in Square 9 GlobalForms 6.2. To verify the vulnerability is legitimate, the end user will be required to do math e.g. Subtracting the smaller...
CVE-2022-1388-EXP
CVE-2022-1388-EXP This is CVE-2022-1388-EXP Author:Caps@BUGFOR Github:https://github.com/bytecaps Remaker:LinJacck Github:https://github.com/LinJacck Feature Display Verification mode: python CVE20221388.py -v -u targeturl Attack mode: python CVE20221388.py -a -u targeturl -c command Batch...
motioneye-authenticated-RCE
MotionEye/MotionEyeOS Authenticated RCE A Python 3 script that uploads a tasks.pickle file that enables RCE in MotionEye. You need administrator credentials, so it should not be that big of a deal. Unfortunately, MotionEye/MotionEyeOS can frequently be found running with default credentials...
CVE-2026-9198
CVE-2026-9198 Vulnerability cause: IBM Langflow OSS is an open-source software specifically used for building and deploying Agent automation workflows. IBM Langflow OSS from 1.0.0 to 1.10.0 has automatic login enabled by default autologin is true. In this mode, accessing the /api/v1/autologin...
CVE-2026-52824
CVE-2026-52824: Kimai Default APPSECRET Login Link Forgery Field| Value ---|--- CVE| CVE-2026-52824 Advisory| GHSA-jr9p-4h4j-6c58 Severity| Critical CWE| CWE-1188, Initialization of a Resource with an Insecure Default Affected| kimai/kimai = 2.57.0 Fixed| 2.58.0 Advisory published| 2026-06-11 Add...
CVE-2026-11116-SNMPv3-Authentication-Bypass-via-Default-EngineID
CVE-2026-11116 β SNMPv3 Authentication Bypass via Default EngineID Program Code Python with pysnmp snmpagentsim.py - SNMPv3 agent using well-known EngineID from pysnmp.hlapi import def snmpgetengineid=SnmpEngineIDhexValue='8000000001020304': iterator = getCmd SnmpEngineengineID=engineid,...
BlockGuard
π‘οΈ BlockGuard β Process-Based File Access Security Agent BlockGuard is a Windows Data Loss Prevention DLP agent that intercepts and controls file access at the process level. It ensures that only authorized processes β identified by executable path, cryptographic hash, Authenticode signature, and...
Zena-CVE-2021-45026
Zena - Stored XSS to RCE Exploit POC Exploit POC for Rocket Software's Zena application v. 4.2.1 - Stored XSS to RCE CVE-2021-45025 CVE-2021-45026 https://phoenix-sec.io/2022/06/17/Zena-CookieMonsteRCE.html POC Process: Logs into Zena's webconfig page using default credentials Drops Stored XSS...