Lucene search
+L

307916 matches found

Nuclei
Nuclei
added 2026/09/17 2:05 a.m.88 views

Akkadian Provisioning Manager - Information Disclosure

Akkadian Provisioning Manager is susceptible to information disclosure. The restricted shell provided can be escaped by abusing the Edit MySQL Configuration command. This command launches a standard VI editor interface which can then be escaped. id: CVE-2021-31581 info: name: Akkadian Provisionin...

7.9CVSS5.5AI score0.01217EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.103 views

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php. This in turn can lead ...

9CVSS8AI score0.72182EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.42 views

CentOS Web Panel - OS Command Injection

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution. id: CVE-2021-31324 info: name: CentOS Web Panel - OS Command Injection author: ritikchaddha severity: critical description: | The unprivileged user portal...

10CVSS8.2AI score0.3486EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.74 views

Acmailer - Improper Access Control to OS Command Injection

Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows remote attackers to execute an arbitrary OS command, or gain an administrative privilege which may result in obtaining the sensitive information on the server via unspecified...

10CVSS8.5AI score0.07871EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.115 views

Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection

Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-42071 info: name: Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection author: gy741 severity: critical description: Visual...

10CVSS8.5AI score0.69882EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.126 views

Apache Airflow OS Command Injection

Apache Airflow prior to version 2.2.4 is vulnerable to OS command injection attacks because some example DAGs do not properly sanitize user-provided parameters, making them susceptible to OS Command Injection from the web UI. id: CVE-2022-24288 info: name: Apache Airflow OS Command Injection...

8.8CVSS7.8AI score0.7788EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.92 views

Razer Sila Gaming Router - Remote Code Execution

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. id: CVE-2022-29013 info: name: Razer Sila Gaming Router - Remote Code Execution author: DhiyaneshDK severity: critical descriptio...

9.8CVSS8.5AI score0.76905EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.133 views

Tenda Router AC11 - Remote Command Injection

Tenda Router AC11 is susceptible to remote command injection vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-31755 info: name: Tenda Router AC11 - Remote Comman...

10CVSS8.6AI score0.86891EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.349 views

Ncast busiFacade - Remote Command Execution

The Ncast Yingshi high-definition intelligent recording and playback system is a newly developed audio and video recording and playback system. The system has RCE vulnerabilities in versions 2017 and earlier. id: CVE-2024-0305 info: name: Ncast busiFacade - Remote Command Execution author: BMCel...

7.5CVSS6.6AI score0.66932EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.28 views

NetAlertX 23.01.14–24.x < 24.10.12 - Remote Code Execution

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php. id: CVE-2024-46506 info: name:...

10CVSS7.6AI score0.62045EPSS
SaveExploits4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.30 views

Group-Office < 26.0.5 - Remote Code Execution

Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmpfile into an exec call. By injecting shell metacharacters into...

9.4CVSS6.5AI score0.18536EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.32 views

TitanNit Web Control 2.01/Atemio 7600 - Remote Code Execution

The device contains a command injection caused by the 'getcommand' query in the application, letting unauthorized attackers execute system commands with root privileges, exploit requires attacker to send crafted requests. id: CVE-2024-9166 info: name: TitanNit Web Control 2.01/Atemio 7600 - Remot...

9.3CVSS5.9AI score0.01578EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.134 views

LiteLLM - Server-Side Request Forgery

LiteLLM vulnerable to Server-Side Request Forgery SSRF vulnerability Exposes OpenAI API Keys. id: CVE-2024-6587 info: name: LiteLLM - Server-Side Request Forgery author: pdresearch,iamnoooob,rootxharsh,lambdasawa severity: high description: | LiteLLM vulnerable to Server-Side Request Forgery SSRF...

7.5CVSS7.6AI score0.35316EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.11 views

Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection

Sangoma Switchvox before version 8.4.0.2 contains an unauthenticated SQL injection vulnerability in the /pa endpoint PhoneAppsHandler.pm. The PhoneIP field extracted from an XML POST body is concatenated directly into an unparameterized PostgreSQL query that runs as a database superuser. An...

9.8CVSS6.8AI score0.11845EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.131 views

UniFi OS Server - Command Injection

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. id: CVE-2026-34910 info: name: UniFi OS Server - Command Injection author: Kazgangap severity: critical description: | A malicious actor...

10CVSS8.2AI score0.87468EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.50 views

Blink Router - Command Injection

Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bsSetSSIDHide function. id: CVE-2025-45985 info: name: Blin...

9.8CVSS8.2AI score0.06861EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.104 views

ZTE Cable Modem Web Shell

ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests to webshellcmd.gch, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. id: CVE-2014-2321 info: name: ZTE Cable Modem Web Shell author:...

10CVSS7.3AI score0.59259EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.159 views

Dreambox WebControl 2.0.0 - Cross-Site Scripting

Dream Multimedia Dreambox devices via their WebControl component are vulnerable to reflected cross-site scripting, as demonstrated by the "Name des Bouquets" field, or the file parameter to the /file URI. id: CVE-2017-15287 info: name: Dreambox WebControl 2.0.0 - Cross-Site Scripting author:...

6.1CVSS6.2AI score0.06147EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.233 views

Apache Struts2 S2-052 - Remote Code Execution

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type of filtering, which can lead to remote code execution when deserializing XML payloads. id: CVE-2017-9805 info: name:...

8.1CVSS7.4AI score0.99396EPSS
SaveExploits24References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.64 views

TotoLink Router setMacFilterRules - Command Injection

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function. id: CVE-2024-24328 info: name: TotoLink Router setMacFilterRules - Command Injection author: pussycat0x severity: critical description: |...

9.8CVSS8.1AI score0.06172EPSS
SaveExploits1References1
Rows per page
Query Builder