GNU-Inetutils-telnet-CVE-2026-24061-

CVE-2026-24061 GNU Inetutils Telnetd Authentication Bypass Vulnerability Detection Tool 📋 Project Overview This is an advanced detection tool for the GNU Inetutils Telnetd authentication bypass vulnerability CVE-2026-24061. This vulnerability has a CVSS score of 9.8, allowing attackers to obtain...

CVE-2026-22015-Serverless-Function-Environment-Variable-Injection-via-Event

CVE-2026-22015 – Serverless Function Environment Variable Injection via Event Program Code Python Lambda sim root@kitploit: lambdaenvinject.py - Vulnerable function that reads env from event import os, json def handlerevent, context: The event contains environment variable overrides debug feature...

telnet_scan

Telnet Vulnerability Scanner CVE-2026-24061 & CVE-2026-32746 A Python-based security assessment tool that detects and where applicable exploits two critical vulnerabilities in GNU InetUtils telnetd: CVE-2026-24061 – Authentication bypass via USER environment variable injection CVSS 9.8...

goahead-webserver-pre-5.1.5-RCE-PoC-CVE-2021-42342-

Goahead webserver pre v5.1.5 RCE PoC CVE-2021-42342 A recent bug in Goahead Webserver was discovered by William Bowling which leads to RCE on the exploited server. The issue exists prior to version 5.1.5 which, according to Shodan covers around 2.8mio servers on the internet. A CVS is available n...

CVE-2014-6271

CVE-2014-6271 Shellshock Python Exploit A clean, efficient, and interactive Python implementation designed to test for the Shellshock vulnerability CVE-2014-6271 via HTTP environment variable injection. 📝 Description Shellshock CVE-2014-6271 is a critical security vulnerability in the Bash shell...

CVE-2026-12940-Langflow-Unauth-RCE

CVE-2026-12940 — Langflow OSS ≤ 1.10.1 Unauthenticated RCE MCP stdio env-var injection Unauthenticated remote code execution in Langflow OSS through 1.10.1. The environment-variable blocklist that guards MCP stdio server configuration DANGEROUSENVVARS omits SHELLOPTS, BASHOPTS and PS4. Because th...

CVE-2021-4034-pwnkit

CVE-2021-4034, PwnKit Proof of concept for PwnKit, a local privilege escalation in polkit's pkexec. On a default install any unprivileged local user can become root. About the bug Vulnerable versions of pkexec mishandle the process argument count. That lets controlled environment variables get...

-CVE-2014-6271

root@kitploit: / || | | | | | | | / || | | |/ \ / | |/ / \ | || | | | | | | \ | || | | | | | | ' / | | || || | | | || | || . \ |/|| |||||/|| ||/ ||\ CVE-2014-6271 — Shellshock Remote Code Execution via Bash Environment Variable Injection "A flaw hidden in Bash for decades that shook the...

Shocker-TJNULL-OSCP-

HackTheBox: Shocker Writeup A structured and professional walkthrough showcasing the identification and manual exploitation of the critical Shellshock vulnerability, followed by local privilege escalation via misconfigured sudo rights on a Linux target. Technical Overview Target OS: Linux IP...

CVE-2014-6271-Shellshock-

Exploiting Shellshock CVE-2014-6271: A Complete, Modern Demonstration Lab Shellshock CVE-2014-6271 is one of the most influential remote code execution vulnerabilities ever discovered. The flaw affects Bash and allows attackers to execute arbitrary commands simply by injecting crafted payloads in...

CVE-2026-24061

Herramienta de detección masiva de la vulnerabilidad CVE-2026-24061 ⚠️ Nota : CVE-2026-24061 GNU Inetutils es un conjunto de herramientas de red clásicas proporcionado por el proyecto GNU, que incluye el servicio telnetd, es decir, el demonio del servidor Telnet. En las versiones 1.9.3 a 2.7, el...

CVE-2026-53541

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-53541 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Oracle Mysql_Server

--- CVE-2026-22015 – Serverless Function Environment Variabl...

Exploit for CVE-2026-12940

CVE-2026-12940 — Langflow OSS ≤ 1.10.1 Unauthenticated RCE MC...

CVE-2026-12940

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

EUVD-2026-51240

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

CVE-2026-12940

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

PT-2026-71450

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.55 Description Improper handling of URL expansion in Remote.create and Submodule.add allows for the exfiltration of secrets. Attackers can provide URLs containing environment variable tokens that are expanded in...

CVE-2026-62203

OpenClaw vulnerable before version 2026.6.6 due to an environment variable filtering issue in host exec that fails to sanitize rustup startup variables. Affected product: OpenClaw. Root cause: improper sanitization of environment variables during rustup startup. Impact: attackers with lower-trust...