CVE-2026-82668

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-82668 klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-82668

klaussilveira GitList 2.0.0 is affected by an OS command injection vulnerability in the getDefaultBranch function of the Git Command Line component (src/SCM/System/Git/CommandLine.php). The attack is remotely exploitable with no authentication or user interaction required. A proof-of-concept expl...

CVE-2026-39808

CVE-2026-39808 Fortinet FortiSandbox 4.4.0-4.4.8 - OS Command Injection via tracer-behavior Endpoint Fortinet FortiSandbox is an advanced threat protection solution that creates isolated environments to analyze suspicious files, URLs, and network traffic for malicious behavior. It uses a...

CVE-2026-48030

CVE-2026-48030 — OS Command Injection in Pheditor Overview...

CVE-2026-22553-InSAT-MasterSCADA-BUK-TS-MMadmServ

InSAT MasterSCADA BUK-TS - Unauthenticated RCE CVE-2026-22553 | CVSS 9.8 Critical | Exploit Author Mohammed Idrees Banyamer 📝 Description InSAT MasterSCADA BUK-TS suffers from an Unauthenticated OS Command Injection vulnerability in the MMadmServ web interface. This flaw allows remote attackers t...

CVE-2021-46422

CVE-2021-46422 SDT-CW3B1 South Korean wireless router OS cmd injection PoC Installation root@kitploit: git clone https://github.com/ZAxyr/CVE-2021-46422.git cd CVE-2021-46422 pip3 install -r requirements.txt Usage Single URL pocsuite -r pocs/CVE-2021-46422.py -u IP Batch URLs pocsuite -r...

Vulnerability-Research

🛡️ Vulnerability Research Here, I catalog the vulnerabilities I've discovered, the corresponding write-ups containing details of the weaknesses, and insights into their impact and remediation. 🏆 Assigned CVEs...

CVE-2024-56115

CVE-2024-56115 Suggested description A vulnerability in Amiro.CMS before 7.8.4 exists due to the failure to take measures to neutralize special elements. It allows remote attackers to conduct an Cross-Site Scripting XSS attack. Vulnerability Type CWE-78 | Improper Neutralization of Special Elemen...

Vulnerability-CVE-2025-64446-CVE-2025-58034

FortiWeb Exploitation Simulation CVE-2025-64446 & CVE-2025-58034 Note: This document is for educational and security research purposes only. Do not use to attack systems without permission. 1. Overview FortiWeb is a Web Application Firewall WAF device used to protect web applications. In 2025, tw...

Artica Web Proxy 4.30 - OS Command Injection

Artica Web Proxy 4.30 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via servicecmdspeform. id: CVE-2020-17505 info: name: Artica Web Proxy 4.30 - OS Command Injection author: dwisiswant0...

Wavlink WN535K2/WN535K3 - OS Command Injection

Wavlink WN535K2 and WN535K3 routers are susceptible to OS command injection which affects unknown code in /cgi-bin/nightled.cgi via manipulation of the argument starthour. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised syste...

Enigma NMS < 65.0.0 - Authenticated OS Command Injection

An OS command injection vulnerability in the discoverandmanage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an authenticated attacker to execute arbitrary code because of improper neutralization of shell metacharacters in the ipaddress variable within an snmpbrowser action. id:...

D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injection

OS Command injection vulnerability in D-Link DIR820LA1FW105B03 allows attackers to escalate privileges to root via a crafted payload with the pingaddr parameter to ping.ccp. id: CVE-2023-25280 info: name: D-Link DIR820LA1FW105B03 'pingaddr' - OS Command Injection author: pussycat0x severity:...

NUUO Camera <=20250203 - OS Command Injection

NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handleconfig.php, letting remote attackers execute arbitrary commands, exploit requires remote access. id: CVE-2025-1338 info: name: NUUO Camera =20250203 - OS Command Injection author: Ark...

rConfig <= 3.9.4 - Authenticated OS Command Injection

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.9.4 does not properly sanitize the fileName POST parameter before using it in a shell command, allowing an authenticated attacker to inject arbitrary OS commands. This template uses default admin credentials to log in before triggering the...

Advantech R-SeeNet 2.4.12 - OS Command Injection

Advantech R-SeeNet 2.4.12 is susceptible to remote OS command execution via the ping.php script functionality. An attacker, via a specially crafted HTTP request, can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering...

cPH2 Charging Station v1.87.0 - OS Command Injection

An OS command injection vulnerability in Hardy Barth cPH2 Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature. id: CVE-2023-46359 info: name: cPH2...

MajorDoMo thumb.php - OS Command Injection

MajorDoMo aka Major Domestic Module before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager. id: CVE-2023-50917 info: name: MajorDoMo thumb.php - OS Command Injection author: DhiyaneshDK severity: critical...

pfSense pfBlockerNG <=2.1..4_26 - OS Command Injection

pfSense pfBlockerNG through 2.1.426 is susceptible to OS command injection via root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected. id: CVE-2022-31814 info: name: pfSense pfBlockerNG =2.1..427 to mitigate this vulnerability. reference: -...