CVE_2024_20356

CVE-2024-20356 这是CVE-2024-20356的概念验证代码，该漏洞是Cisco CIMC中的一个命令注入漏洞。 由Aaron编写，由SherllyNeo进行Rust化。 完整技术细节见 https://labs.nettitude.com/blog/cve-2024-20356-jailbreaking-a-cisco-appliance-to-run-doom 安装 cargo build --release && cp ./target/release/CVE202420356 /.local/bin/ 用法 Usage: CVE202420356 OPTIONS...

CVE-2026-63077

Resumen • Flujo visual • Requisitos • Uso • Limitaciones • Mitigación !CAUTION Este PoC ejecuta un comando del sistema operativo y puede modificar el directorio de la aplicación TeamCity. Úselo únicamente en un laboratorio aislado o contra sistemas para los que tenga autorización explícita por...

Langflow <=1.2.x - Unauthenticated Remote Code Execution via validate_code

Langflow = 1.2.x exposes POST /api/v1/validate/code without any authentication. The endpoint calls validatecode which execs user-supplied Python code. Default-argument expressions in Python execute at function-definition time, allowing arbitrary OS command execution without authentication. id:...

CVE-2024-27348

CVE-2024-27348 🪶 CVE-2024-27348 概念验证利用——Apache HugeGraph Server 中的 RCE 未认证用户可通过 Groovy 注入在 Apache HugeGraph Server 上执行操作系统命令。 使用 🛠 攻击多个目标 ☣️ python3 CVE-2024-27348.py -f targets.txt -c "command to execute" 攻击单个目标 🗡 python3 CVE-2024-27348.py -t http://target.tld:8080 -c "command to execute" 参数 🧰 参数...

CVE-2021-27928

CVE-2021-27928 在本仓库中，你将找到通过一个 docker 容器利用 CVE-2021-27928 漏洞的概念验证代码。 Exploit Title: MariaDB 10.2 /MySQL - 'wsrepprovider' OS Command Execution Date: 03/18/2021 Exploit Author: Central InfoSec Version: MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, 10.5 before 10.5.9; Percon...

AlmaLinux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1778856286)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778856286 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command...

AlmaLinux 9.2 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.2:CLSA-2026:1778858288)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778858288 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command...

Rocky Linux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1778856286)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778856286 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command...

AlmaLinux 9.2 [TuxCare] Security Update: less (ALMALINUX9.2:CLSA-2024:1715672446)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1715672446 advisory. - less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c...

CVE-2026-102136

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be...

CVE-2026-102120 Kiteworks Core OS Command Injection

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in ...

CVE-2026-102136 Kiteworks Core Command Execution through Configuration Injection

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be...

CVE-2019-9193-Home-Lab

CVE-2019-9193 — PostgreSQL COPY FROM PROGRAM RCE 本实验室模拟 CVE-2019-9193 ，这是一个 PostgreSQL 9.3–11.2 版本中的漏洞，允许： COPY ... FROM PROGRAM '' 当超级用户或拥有 pgexecuteserverprogram 角色的用户执行时，可以运行操作系统命令。 你的任务是利用此功能读取： /tmp/flag.txt 目标 1. 连接到 PostgreSQL： 用户：postgres 密码：sentinel7 主机端口：5433 2. 使用 COPY FROM PROGRAM ：...

CVE-2026-78229

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations...

CVE-2026-78229

The Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker with the ability to log in to a Linux system where the affected product is installed may execute arbitrary OS commands by making specific preparations. Exploitation details are not provided in the docum...

CVE-2026-78229

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations...

CVE-2024-29269

CVE-2024-29269 Que permite la ejecución de comandos del sistema operativo sin autenticación en routers TLR-2005KSH. Este exploit aprovecha la vulnerabilidad para ejecutar comandos arbitrarios en los routers afectados. Dork ZoomEye :- title:"Login to TLR-2005KSH" Fuente:...

CVE-2026-87969 WatchGuard AP Authenticated Command Injection in Diagnostic CLI

An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input...

wp2shell

wp2shell 针对 WordPress 6.9.0–6.9.4 和 7.0.0–7.0.1 的预认证远程代码执行。 将 CVE-2026-63030（批量路由混乱 SQL 注入）与 CVE-2026-60137（自定义器变更集重入）串联，实现未认证管理员创建和操作系统命令执行。无需破解密码。 特别感谢 hashkitten 的发现，完整技术分析见 此处。 漏洞 WordPress 的 REST API 批量处理器（servebatchrequestv1）存在一个差一（off-by-one）索引 bug：当 wpparseurl 在子请求路径上失败时，产生的 WPError 会被推入...

CVE-2026-91006

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...