CVE-2021-46422

CVE-2021-46422 SDT-CW3B1 1.1.0 - 操作系统命令注入 root@kitploit: Exploit Title: SDT-CW3B1 1.1.0 - OS Command Injection Vendor Homepage: http://telesquare.co.kr/ CVE : CVE-2021-46422 CVE Description: Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote...

xzwhy

xzwhy root@kitploit: / / / / \ / /\ Este proyecto es una prueba de concepto POC compatible con Kubernetes para CVE-2024-3094 que afecta a XZ Utils. Consulta este artículo para obtener una excelente explicación del origen y la mecánica del exploit. ADVERTENCIA ⚠⚠⚠ Ejecutar cualquiera de los...

CVE-2026-83948

Improper neutralization of special elements used in a command 'command injection' in Microsoft Azure CLI allows an authorized attacker to execute code over a network...

CVE-2026-81380

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

CVE-2026-81349

Improper neutralization of special elements used in an os command 'os command injection' in Azure HDInsights allows an authorized attacker to elevate privileges over a network...

CVE-2026-69716

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-69636

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

CVE-2026-69534

Improper neutralization of special elements used in a command 'command injection' in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

CVE-2017-9822

CVE-2017-9822 DotNetNuke Cookie 反序列化远程代码执行 RCE DotNetNuke DNN 版本 5.0.0 至 9.3.0 存在反序列化漏洞，可导致远程代码执行 RCE。DotNetNuke 使用 DNNPersonalization cookie 来存储匿名用户的个性化选项（已验证用户的选项通过其个人资料页面存储）。当应用程序提供自定义 404 错误页面时（这也是默认设置），会使用此 cookie。 有漏洞的 C 代码如下所示：DNN Platform/Library/Common/Utilities/XmlUtils.cs root@kitploit...

CVE-2026-67370

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-66820

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-66819

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-82537 Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

CVE-2026-82537

Roo-Code through version 3.54.0 contains an auto-approve bypass vulnerability caused by a word-boundary mismatch in comment handling between the approval gate's shell parser and bash . An attacker can craft a command string pairing an allowlisted word with a hash character, separator, and a denie...

EUVD-2026-74041

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

CVE-2026-82537 Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

CVE-2025-57819-exploit

CVE-2025-57819 — FreePBX 预认证 SQL 注入到远程代码执行 针对 CVE-2025-57819 的一体化利用工具，该漏洞是 FreePBX 端点模块中未经认证的 SQL 注入漏洞，可通过 cron 任务注入实现远程代码执行。 CVSS : 9.8（严重）— CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA KEV : 2025 年 8 月 29 日添加 受影响版本 : Sangoma FreePBX 15、16、17，且端点模块版本 │ ▼ 向 cronjobs 表进行 SQL 注入...

CVE-2026-82536 Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line wit...

EUVD-2026-74040

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line wit...

CVE-2026-82536

Roo-Code through version 3.54.0 contains an auto-approve bypass in its shell command parsing logic. The root cause is the omission of the bash pipe operator (specifically the stderr-redirecting pipe) from the parser's operator token set. An attacker can craft a command line combining an allowlist...