Yachtcontrol Webapplication 1.0 - Remote Command Injection Detection

Yachtcontrol Webapplication 1.0 makes it possible to perform direct operating system commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers...

SAP Solution Manager 7.2 - Remote Command Execution Detection

SAP Solution Manager SolMan running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet tcsmdagentapplicationeem. The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information...

NUUO NVRmini - Remote Command Execution Detection

NUUO NVRmini is vulnerable to unauthenticated remote command execution through the upgradehandle.php file. The vulnerability allows an attacker to execute arbitrary commands by manipulating the uploaddir parameter. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini is vulnerable to...

Zeroshell 3.9.0 - Remote Command Execution Detection

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters. !/usr/bin/env python3 -...

Webmin <= 1.920 - Unauthenticated Remote Command Execution Detection

Webmin =1.920. is vulnerable to an unauthenticated remote command execution via the parameter 'old' in passwordchange.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """Webmin =1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Spring Security OAuth2 Remote Command Execution Detection

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote comma...

Ruijie EG Easy Gateway - Remote Command Execution Detection

Ruijie EG Easy Gateway login.php has remote commmand execution vulnerability, which can lead to the disclosure of administrator account and password. !/usr/bin/env python3 -- coding: utf-8 -- """Ruijie EG Easy Gateway login.""" from kittysploit import from lib.protocols.http.httpclient import...

Sangfor Application Login - Remote Command Execution Detection

Sangfor application delivery management system login has a remote command execution vulnerability, through which an attacker can obtain server privileges and execute arbitrary commands !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor application delivery management system login has a remote...

Apache Struts - OGNL Console Detection

This development console allows the evaluation of OGNL expressions that could lead to Remote Command Execution !/usr/bin/env python3 -- coding: utf-8 -- """This development console allows the evaluation of OGNL expressions that could lead to Remote Command Execution.""" from kittysploit import fr...

Synway SMG Gateway 9-2radius.php - Remote Command Execution Detection

Synway SMG Gateway Management Software contains a remote command execution vulnerability in 9-2radius.php, where the radiusaddress parameter is passed to a system call without sanitization. This allows unauthenticated attackers to execute arbitrary commands on the server. !/usr/bin/env python3 --...

TOTOLink Router - Remote Command Execution Detection

TOTOLink routers are vulnerable to unauthenticated remote command execution via the /boaform/formWsc endpoint. An attacker can inject OS commands through the localPin parameter. !/usr/bin/env python3 -- coding: utf-8 -- """TOTOLink routers are vulnerable to unauthenticated remote command executio...

Jupyter Notebook - Remote Command Execution Detection

Jupyter Notebook is an interactive Notebook, computer application is a web based visualization, Jupyter Notebook API/terminals path there are loopholes in the remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Jupyter Notebook is an interactive Notebook, computer application i...

Inspur Clusterengine V4 SYSshell - Remote Command Execution Detection

Inspur Clusterengine V4 SYSshell was found and allows remote command execution by design. !/usr/bin/env python3 -- coding: utf-8 -- """Inspur Clusterengine V4 SYSshell was found and allows remote command execution by design.""" import re from kittysploit import from lib.protocols.http.httpclient...

nginxWebUI ≤ 3.5.0 - Remote Command Execution Detection

There is a command execution vulnerability in the nginxWebUI backend. After logging in to the backend, the attacker can execute any command to obtain server permissions. !/usr/bin/env python3 -- coding: utf-8 -- """There is a command execution vulnerability in the nginxWebUI backend.""" import re...

nginxWebUI ≤ 3.5.0 runCmd - Remote Command Execution Detection

nginxWebUI’s runCmd feature and is caused by incomplete validation of user input. Attackers can exploit the vulnerability by crafting malicious data to execute arbitrary commands on a vulnerable server without authorization. !/usr/bin/env python3 -- coding: utf-8 -- """nginxWebUI’s runCmd feature...

PHP-Fusion 9.03.50 - Remote Code Execution Detection

PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """PHP-Fusion 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Telesquare TLR-2005KSH - Remote Command Execution Detection

Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from South Korea's Telesquare company.Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 have an unauthorized remote command execution vulnerability. An attacker can exploit this vulnerability to execute system commands without authorization through...

CVE-2026-16812 VeloCloud Orchestrator OS Command Injection

VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...

CVE-2026-59920

A flaw was found in the Netty STOMP Streaming Text Oriented Messaging Protocol decoder. This vulnerability allows a remote attacker to inject arbitrary protocol frames by crafting malformed STOMP commands that contain embedded carriage return CR and line feed LF sequences. This bypasses message...

Security Advisory 0144

Security Advisory 0144 . CSAF PDF Date: July 27, 2026 Revision | Date | Changes ---|---|--- 1.0 | July 27, 2026 | Initial release 1.1 | August 3, 2026 | Updated Affected Platforms to include: VeloCloud Orchestrator Hosted 1.2 | August 10, 2026 | Added CSAF JSON file for download The CVE-ID tracki...