Lucene search
+L

307874 matches found

Nuclei
Nuclei
added 2026/09/17 2:05 a.m.104 views

ZTE Cable Modem Web Shell

ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests to webshellcmd.gch, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. id: CVE-2014-2321 info: name: ZTE Cable Modem Web Shell author:...

10CVSS7.3AI score0.59259EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.159 views

Dreambox WebControl 2.0.0 - Cross-Site Scripting

Dream Multimedia Dreambox devices via their WebControl component are vulnerable to reflected cross-site scripting, as demonstrated by the "Name des Bouquets" field, or the file parameter to the /file URI. id: CVE-2017-15287 info: name: Dreambox WebControl 2.0.0 - Cross-Site Scripting author:...

6.1CVSS6.2AI score0.06147EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.233 views

Apache Struts2 S2-052 - Remote Code Execution

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type of filtering, which can lead to remote code execution when deserializing XML payloads. id: CVE-2017-9805 info: name:...

8.1CVSS7.4AI score0.99396EPSS
SaveExploits24References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.64 views

TotoLink Router setMacFilterRules - Command Injection

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function. id: CVE-2024-24328 info: name: TotoLink Router setMacFilterRules - Command Injection author: pussycat0x severity: critical description: |...

9.8CVSS8.1AI score0.06172EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.126 views

Linksys RE7000 - Command Injection

Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access control function point id: CVE-2024-25852 info: name: Linksys RE7000 - Command Injection author: s4e-io severity: high description: | Linksys RE7000 v2.0.9, v2.0.1...

8.8CVSS7.9AI score0.16519EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.56 views

Xceedium Xsuite <=2.4.4.5 - Local File Inclusion

Xceedium Xsuite 2.4.4.5 and earlier is vulnerable to local file inclusion via opm/readsessionlog.php that allows remote attackers to read arbitrary files in the logFile parameter. id: CVE-2015-4666 info: name: Xceedium Xsuite =2.4.4.5 - Local File Inclusion author: 0xAkoko severity: medium...

5CVSS8.3AI score0.16235EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.53 views

FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution

Custom css-js-php WordPress plugin through 2.0.7 contains a command injection caused by unsanitized user input used in SQL query and passed to eval, letting unauthenticated attackers execute arbitrary PHP code on the server. id: CVE-2026-6433 info: name: FlipperCode Custom CSS, JS & PHP = 2.0.7 -...

7.3CVSS7.9AI score0.01195EPSS
SaveExploits3References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.71 views

OpenDreambox 2.0.0 - Remote Code Execution

OpenDreambox 2.0.0 is susceptible to remote code execution via the webadmin plugin. Remote attackers can execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI in enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py. id: CVE-2017-14135 info: nam...

10CVSS8.9AI score0.21842EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.26 views

Xdebug <= 2.5.5 - Command Injection

Xdebug = 2.5.5 contains an unauthenticated command injection caused by accepting debugger protocol commands without authentication when remote debugging is enabled, letting remote attackers execute arbitrary PHP code and system commands, exploit requires remote debugging enabled. id: CVE-2015-101...

9.3CVSS6.3AI score0.07386EPSS
SaveExploits2References6
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.221 views

OpenCode < 1.0.216 - Unauthenticated Remote Code Execution

OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution vulnerability. The application exposes session and shell execution endpoints without proper authentication, allowing remote attackers to create sessions and execute arbitrary shell commands on the underlying serve...

8.8CVSS8.6AI score0.16771EPSS
SaveExploits8References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.51 views

Pandora FMS 7.0NG - Remote Command Injection

Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ipsrc parameter in an index.php?operation/netflow/nfliveview request. id: CVE-2019-20224 info: name: Pandora FMS 7.0NG - Remote Command Injection author: ritikchaddha severity: hig...

9CVSS7.9AI score0.4968EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.103 views

TOTOLink - Unauthenticated Command Injection

TOTOLink A950RG V5.9c.4050B20190424 and V4.1.2cu.5204B20210112 were discovered to contain a command injection vulnerability in the Main function. This vulnerability allows attackers to execute arbitrary commands via the QUERYSTRING parameter. id: CVE-2022-25082 info: name: TOTOLink -...

9.8CVSS8.5AI score0.15673EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.87 views

D-Link Routers - Remote Command Injection

D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 device may allow an authenticated attacker to execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for...

9CVSS8.5AI score0.77699EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.90 views

LogonTracer <=1.2.0 - Remote Command Injection

LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. id: CVE-2018-16167 info: name: LogonTracer =1.2.0 - Remote Command Injection author: gy741 severity: critical description: LogonTracer 1.2.0 and earlier allows remote attackers to execu...

10CVSS8.7AI score0.74916EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.56 views

WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion

WirelessHART Fieldgate SWG70 3.0 is vulnerable to local file inclusion via the fcgi-bin/wgsetcgi filename parameter. id: CVE-2018-16059 info: name: WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion author: daffainfo severity: medium description: WirelessHART Fieldgate SWG70 3.0 is vulnerabl...

5.3CVSS5.9AI score0.29816EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.68 views

Apache Solr DataImportHandler <8.2.0 - Remote Code Execution

Apache Solr is vulnerable to remote code execution vulnerabilities via the DataImportHandler, an optional but popular module to pull in data from databases and other sources. The module has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug...

9CVSS7.6AI score0.83547EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.26 views

Zeroshell 3.9.3 - Command Injection

Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character. id: CVE-2020-29390 info: name: Zeroshell 3.9.3 - Command...

10CVSS8.3AI score0.39565EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.47 views

ICTBroadcast - Command Injection

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are know...

9.3CVSS7.8AI score0.05661EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.37 views

FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection

FreePBX Endpoint Manager 17.0.2.36 to = 17.0.2.36 && 17.0.3 - Authenticated Command Injection author: th3y severity: critical description: | FreePBX Endpoint Manager 17.0.2.36 to 17.0.3 contains a command injection caused by improper sanitization in filestore module's testconnection checksshconne...

8.6CVSS7.5AI score0.84618EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.63 views

Aquatronica Controller System <= 5.1.6 - Information Disclosure

Aquatronica Controller System firmware 5.1.6 and earlier and web interface 2.0 and earlier contain an information disclosure vulnerability caused by unauthenticated access to tcp.php endpoint, letting remote attackers retrieve sensitive configuration data including plaintext credentials, exploit...

9.3CVSS5.8AI score0.01542EPSS
SaveExploits1References4
Rows per page
Query Builder