CVE-2026-119742

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the installmib function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before...

CVE-2026-119742 Nagios XI < 2026R2 OS Command Injection via mibs.php

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the installmib function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before...

EUVD-2026-115824

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the installmib function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before...

CVE-2026-119742

Nagios XI versions prior to 2026R2 are vulnerable to an OS command injection flaw in the MIB upload feature. The root cause is located in the install_mib() function within mibs.php, which employs an incomplete character deny-list that fails to filter semicolons and pipes. An authenticated adminis...

PT-2026-136126

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2026R2 Description An OS command injection issue exists in the MIB upload feature. The install mib function in the mibs.php file uses an incomplete character-substitution filter when sanitizing uploaded filenames,...

react2shell-scanner

react2shell-scanner A high-fidelity command-line vulnerability scanner for detecting CVE-2025-55182 and CVE-2025-66478 Remote Code Execution in Next.js applications using React Server Components RSC. 🚨 Vulnerability Overview These critical vulnerabilities affect Next.js applications using React...

react2shell-scanner

react2shell-scanner A command-line tool for detecting CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server Components. For technical details on the vulnerability and detection methodology, see our blog post:...

Voicent SaveFileServlet unauthenticated JSP RCE

Unauthenticated multipart POST /savefile.jsp with forwardpage auth bypass writes a JSP under the web root; subsequent GET executes arbitrary commands. """Voicent Call Center SaveFileServlet unauthenticated JSP upload RCE.""" from future import annotations import uuid from urllib.parse import quot...

PHP 8.5.11 Session Upload Progress Detection

A CrowdSec AppSec rule blocks multipart POST requests containing PHP's PHPSESSIONUPLOADPROGRESS field as defense in depth for affected PHP versions...

PHP2Shell: What defenders need to know about CVE-2026-109618 and CVE-2026-109619

PHP2Shell: What defenders need to know about CVE-2026-109618 and CVE-2026-109619 By Trellix Advanced Research Center · October 22, 2026 What happened On October 21, 2026, the PHP project released emergency fixes for two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and...

Exploit for CVE-2026-109618

CVE-2026-109618 / CVE-2026-109619 — PHP session.uploadprogres...

React-2-Shell

This is a security exploit tool targeting CVE-2025-55182. It exploits a Remote Code Execution RCE vulnerability in React Server Components 🔥 CVE-2025-55182 Background CVE-2025-55182 also widely referred to as “React2Shell” is a critical remote code execution RCE vulnerability found in React Serve...

PT-2026-72015

Name of the Vulnerable Software and Affected Versions Netis NC63 version V3.0.0.3327 Description An authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher allows unauthenticated attackers to upload unsigned firmware images. The Boa web server grants access to any path...

Ubiquiti AirOS - Unauthenticated CLI RCE Detection

Detects AirOS unauth RCE by POSTing multipart exec=cat /etc/passwd&action=cli to /admin.cgi/sd.css with a forged AIROSSESSIONID cookie. !/usr/bin/env python3 -- coding: utf-8 -- """Detects AirOS unauth RCE by POSTing multipart exec=cat /etc/passwd&action=cli to /admin.""" import re from kittysplo...

Zyxel NAS - setCookie Command Injection (CVE-2024-29973)

Exploits unauthenticated command injection in Zyxel NAS via multipart POST to /cmd,/simZysh/registermain/setCookie. Command output is returned; opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS setCookie command injection CVE-2024-29973 — opens execute...

Ubiquiti AirOS - Unauthenticated CLI RCE

Exploits AirOS unauthenticated CLI execution via multipart POST to admin.cgi/sd.css with a forged AIROSSESSIONID cookie. !/usr/bin/env python3 -- coding: utf-8 -- """Ubiquiti AirOS unauthenticated CLI RCE.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Zyxel NAS - setCookie Command Injection Detection (CVE-2024-29973)

Detects Zyxel NAS command injection via multipart POST to /cmd,/simZysh/registermain/setCookie CVE-2024-29973 and related Jun 2024 issues. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS setCookie command injection CVE-2024-29973 family.""" import re import secrets from kittysploit import...

Generic Upload Webshell Probe

Probe generic file upload surfaces multipart POST for unrestricted extension handling and verify a harmless PHP/ASP execution marker. !/usr/bin/env python3 -- coding: utf-8 -- """ Generic multipart upload → webshell probe non-WordPress. Tests common upload endpoints and parameter names with a...

CVE-2024-14037 Redsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob

Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious files through the PtFjk.mob servlet endpoint. Attackers can submit a multipart POST request with a JSP webshell disguised using a spoofed...

CVE-2024-14037: Unrestricted Upload of File with Dangerous Type

Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious files through the PtFjk.mob servlet endpoint. Attackers can submit a multipart POST request with a JSP webshell disguised using a spoofed...