gdbfuzz

GDBFuzz: Debugger-Driven Fuzzing This is the companion code for the paper: 'Fuzzing Embedded Systems using Debugger Interfaces'. A preprint of the paper can be found here https://publications.cispa.saarland/3950/. The code allows the users to reproduce and extend the results reported in the paper...

IoT-PT-v1

🛠️ IoT-PT OS v1 物联网渗透测试操作系统 - 版本 1 📦 什么是 IoT-PT OS v1？ IoT-PT OS v1 是一款专为物联网安全评估设计的渗透测试虚拟机。它预配置了针对固件分析、嵌入式系统攻击、无线破解等场景的工具、脚本和环境。 💾 下载 直接链接 ：下载 IoT-PT OSv1 校验和： root@kitploit: MD5: d9c20057b14cfa3fb25f744813b828df SHA1: 8828d693dc6c809377bab40d2bc26f525685e287 📷 截图 🧰 系统信息与要求 组件| 最低要求 ---|--- 基础系统|...

openclarity

OpenClarity is an open source tool for agentless detection and management of Virtual Machine Software Bill Of Materials SBOM and security threats such as vulnerabilities, exploits, malware, rootkits, misconfigurations and leaked secrets. Join OpenClarity's Slack channel to hear about the latest...

EUVD-2026-75766

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-75769

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

EUVD-2026-75765

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

EUVD-2026-75774

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

EUVD-2026-75794

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command...

CVE-2026-26832

CVE-2026-26832: Inyección de comandos del sistema operativo en node-tesseract-ocr Resumen node-tesseract-ocr hasta la versión 2.2.1 permite la inyección de comandos del sistema operativo en recognize en src/index.js. El paquete construye una cadena de comando de shell y la ejecuta con...

Ubiquiti UniFi OS Server < 5.1.37 Multiple Vulnerabilities

The version of Ubiquiti UniFi OS Server installed on the remote host is prior to 5.1.37. It is, therefore, affected by multiple vulnerabilities: - A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability fou...

CVE-2021-27928

CVE-2021-27928 在本仓库中，你将找到通过一个 docker 容器利用 CVE-2021-27928 漏洞的概念验证代码。 root@kitploit: Exploit Title: MariaDB 10.2 /MySQL - 'wsrepprovider' OS Command Execution Date: 03/18/2021 Exploit Author: Central InfoSec Version: MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, 10.5 before...

CVE-2020-8958

Una prueba de concepto para CVE-2020-8958 escrita en Python. El script devolverá el contenido de /etc/passwd si tiene éxito. CVE-2020-8958 Los dispositivos Guangzhou 1GE ONU V2801RW 1.9.1-181203 hasta 2.9.0-181024 y V2804RGW 1.9.1-181203 hasta 2.9.0-181024 permiten a atacantes remotos ejecutar...

CVE-2026-26830

CVE-2026-26830：pdf-image 中的 OS 命令注入 摘要 pdf-image 直到版本 2.0.0 均存在通过 pdfFilePath 参数导致的 OS 命令注入漏洞。该包使用 util.format 构建 shell 命令字符串，并通过 childprocess.exec 执行。如果应用程序将攻击者控制的文件路径传入 PDFImage，该路径中的 shell 元字符可能导致任意命令执行。 受影响产品 产品| 受影响版本| 修复版本 ---|---|--- pdf-image| 直到 2.0.0 的所有版本| 截至 2026-03-24 无可用修复 漏洞详情 CVE...

CVE-2026-17176 OS command injection Vulnerability in Deco BE11000

An OS command injection vulnerability in the TDDP module of Deco BE11000 allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized command execution...

CVE-2026-17176

TP-Link Deco BE11000 is affected by an OS command injection vulnerability in its TDDP module . An attacker on the adjacent network can exploit this by sending a crafted UDP packet , executing arbitrary commands with root privileges without any prior authentication. Successful exploitation may lea...

CVE-2025-61304

CVE-2025-61304 Dynatrace ActiveGate ping扩展（版本1.016及以下）中通过精心构造的IP地址存在的OS命令注入漏洞 在后台，ping扩展使用Windows命令提示符来执行ping操作。测试目标主机的输入字段长度为1024个字符。在IP地址之后，只需使用'&'即可写入额外命令供ActiveGate执行。 已向Dynatrace报告，并通过此提交修复： https://github.com/Dynatrace/dynatrace-api/pull/99 利用RCE添加用户： 本地用户列表前后对比： 其他示例载荷： 1...

-CTT-PAN-OS-EXPLOIT-CVE-2024-340

-CTT-PAN-OS-EXPLOIT-CVE-2024-340 CTT-PAN-OS-Exploit – CVE-2024-3400 CVSS 10.0 结合收敛时间理论（Convergent Time Theory）增强。利用 α = 0.0302011 时间色散、33层相位共振级联和11 ns时间楔滤波来利用Palo Alto GlobalProtect命令注入。有效载荷分布在33个时间层中，具有指数优先级 d 以下是 CTT PAN-OS Exploit 的 README 和简短描述： 简短描述 CTT-PAN-OS-Exploit – CVE-2024-3400 CVSS 10...

@argos-ci/core: CI Branch Name OS Command Injection

CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...

CVE-2026-82098

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-82095

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...