CVE-2026-73752 Unauthenticated Arbitrary File Write Vulnerability Leads to Remote Code Execution in AOS-CX

An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution...

EUVD-2026-69616

An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution...

CVE-2026-73751 Authenticated Remote Command Injection in AOS-CX Web-based Management Interface

An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system...

CVE-2026-73751

CVE-2026-73751 is an authenticated remote command injection in the AOS-CX (Aruba) web-based management interface, assigned by HPE . An authenticated user with low-privileged access can submit crafted input through the web interface to execute arbitrary commands on the underlying operating system,...

CVE-2026-73751 Authenticated Remote Command Injection in AOS-CX Web-based Management Interface

An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system...

EUVD-2026-69614

Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit these vulnerabilities by providing specially crafted input from a compromised or hostile authentication server. Successful exploitation could...

CVE-2026-73750

CVE-2026-73750 affects the authentication module of HPE ArubaOS-CX (AOS-CX) , specifically an API endpoint. The root cause is improper handling of malformed or truncated input, constituting a buffer overflow. An authenticated remote attacker—via a compromised or hostile authentication server—can ...

CVE-2026-73750 Authenticated Buffer Overflow Vulnerabilities in AOS-CX API Endpoint Leads to Possible Code Execution

Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit these vulnerabilities by providing specially crafted input from a compromised or hostile authentication server. Successful exploitation could...

EUVD-2026-69613

Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code...

CVE-2026-73749 Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX

Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code...

CVE-2026-73749

CVE-2026-73749 affects a daemon in HPE AOS-CX , where multiple buffer overflow vulnerabilities arise from improper processing of malformed input. An unauthenticated remote attacker can exploit these by sending specially crafted packets to the affected service, potentially achieving remote code ex...

GHSA-6HWM-XVPH-95VM NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

Two NLTK sites executed the Graphviz dot program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named dot where resolution looks the CWD on Windows, ...

EUVD-2026-65226

NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary...

CVE-2019-9202

CVE-2019-9202 Nagios IM 2.6 远程代码执行漏洞利用：CSRF + SQLi + RCE + LPE → 远程 root 描述 通过链式利用跨站请求伪造（CSRF）/授权绕过（CVE-2019-9203），可以触发基于联合查询的SQL注入（CVE-2019-9204）、远程代码执行（RCE，CVE-2019-9202）以及本地权限提升（LPE，CVE-2019-9166），从而在远程Nagios XI服务器上获取root权限。 要求 受害者必须在Nagios XI中经过身份验证；据目前所知，最低权限即可满足条件。 PoC...

golang-webmin-CVE-2022-0824-revshell

golang-webmin-CVE-2022-0824-revshell RCE en Webmin url objetivo c - credenciales para webmin sl - IP y puerto de tu servidor local para alojar tu payload s - IP de callback p - puerto de callback Referencias https://www.webmin.com/security.html...

CVE-2023-3722

CVE-2023-3722 CVE-2023-3722 Avaya Aura Device Services の無制限ファイルアップロード RCE の Python POC。 このスクリプトは、PUT リクエストを使用して、8桁のランダム生成ファイル名を持つ PHP ファイルをアップロードします。次に、GET リクエストを行い、そのファイルを取得し、出力を解析してコマンドの出力を得ます。 実行方法 root@kitploit: python3 ./CVE-2023-3722.py example.com:444 --query "id" root@kitploit: python3...

CVE-2021-3490

Linux 内核中用于位运算（AND、OR 和 XOR）的 eBPF ALU32 边界跟踪未能正确更新 32 位边界，这可能被利用为 Linux 内核中的越界读取和写入，从而导致任意代码执行。 编译：gcc -o pwn pwn.c && gcc -o exploit exploit.c...

CVE-2024-30167

PoC For Atlona OME Authenticated Command Injection Disclaimer : This proof of concept is provided solely for educational and research purposes only. Do not use this code on systems you do not own or have explicit permission to test. I am not responsible for any misuse. An authenticated command...

CVE-2019-2725

CVE-2019-2725 WebLogic通用利用工具 - CVE-2017-3506 / CVE-2017-10271 / CVE-2019-2725 / CVE-2019-2729 载荷构建器与利用 信息/帮助 root@kitploit: $ python3 weblogicexploit.py -h ======================================================================== | WebLogic Universal Exploit | | CVE-2017-3506 / CVE-2017-10271 /...

React2Shell-CVE-2025-55182

🔥React2Shell - CVE-2025-55182 / CVE-2025-66478 概念验证 关键安全漏洞演示 - CVSS 10.0 - React 服务器组件中的远程代码执行 ⚠️免责声明 仅供教育目的使用！ 此仓库演示了一个关键安全漏洞。 切勿在生产系统或公开网络上使用。 🚨漏洞详情 CVE ID: CVE-2025-55182 React / CVE-2025-66478 Next.js CVSS 评分: 10.0（严重） 受影响版本: 带有 React 服务器组件的 Next.js 15.0.0 漏洞类型: 通过 RSC 协议实现的远程代码执行 修复版本:...