cacti-cve-2022-46169-exploit

CVE-2022-46169 PoC: Authentication Bypass and Remote Code Execution This repository contains a PoC for the CVE-2022-46169 vulnerability, which allows an attacker to bypass authentication and execute arbitrary code remotely on the affected system. This vulnerability affects Cacti, version 1.2.22,...

CVE-2024-1874

CVE-2024-1874 Proof Of Concept for CVE-2024-1874 Command Injection via Array-ish $command Parameter of procopen bypass CVE-2024-1874 fix The CVE: In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailin...

CVE-2026-116778

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

CVE-2026-116778 FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

CVE-2026-116778 FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

EUVD-2026-112150

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

CVE-2026-116778

The FOG cloning and imaging suite is vulnerable to root command execution in versions prior to 1.5.10.2253 and 1.6.0-RC-1 . An authenticated API-enabled user (uType=1) with both a personal and a global FOG API token can exploit a missing authorization check on the PUT /fog/storagenode/{id}/edit e...

Cacti CVE-2022-46169 remote_agent RCE

CVE-2022-46169 Cacti = 1.2.22: X-Forwarded-For auth bypass on /remoteagent.php plus unsanitized pollerid passed to procopen. Uses in-band webroot file drop when readable. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti CVE-2022-46169 remoteagent pollerid command injection.""" from future impor...

CVE-2026-114624 baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...

CVE-2026-114624

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...

CVE-2026-43641

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can...

EUVD-2026-84620

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can...

CVE-2026-43641 Softaculous Virtualizor OS Command Injection via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can...

CVE-2026-43641 Softaculous Virtualizor OS Command Injection via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can...

Missing Authentication for Critical Function

Overview icecoder/icecoder is a Browser based code editor allowing you to code from anywhere. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the terminal-xhr.php process. An attacker can execute arbitrary operating system commands by sending a...

CVE-2026-63722

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the...

CVE-2026-63722

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the...

CVE-2026-63722 ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the...

CVE-2026-63722 ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the...

CVE-2026-63722

ICEcoder 8.1 is vulnerable to unauthenticated remote code execution via the terminal-xhr.php endpoint. Attackers chain three flaws: a password parameter bypasses authentication, a non-empty csrf parameter skips CSRF validation, and an arbitrary command string is passed directly to proc_open(), yi...