18695 matches found
Apache HugeGraph-Server - Remote Command Execution
Apache HugeGraph-Server is an open-source graph database that provides a scalable and high-performance solution for managing and analyzing large-scale graph data. It is commonly used in Java8 and Java11 environments. However, versions prior to 1.3.0 are vulnerable to a remote command execution RC...
WS_FTP Server - Insecure Deserialization
In WSFTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WSFTP Server operating system. id: CVE-2023-40044 info: name: WSFTP Server - Insecure...
Oracle WebLogic Server - Remote Command Execution
The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. id: CVE-2019-2725 info: name: Oracle WebLogic...
HTTP File Server <2.3c - Remote Command Execution
HTTP File Server before 2.3c is susceptible to remote command execution. The findMacroMarker function in parserLib.pas allows an attacker to execute arbitrary programs via a %00 sequence in a search action. Therefore, an attacker can obtain sensitive information, modify data, and/or gain full...
Oracle WebLogic Server - Remote Command Execution
Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised machine without entering necessary credentials. See...
Symmetricom SyncServer Unauthenticated - Remote Command Execution
Microchip Technology Microsemi SyncServer S650 was discovered to contain a command injection vulnerability. id: CVE-2022-40022 info: name: Symmetricom SyncServer Unauthenticated - Remote Command Execution author: DhiyaneshDK,mielverkerken severity: critical description: | Microchip Technology...
Mirth Connect 4.4.0 Remote Command Execution
NextGen Healthcare Mirth Connect versions before version 4.4.1 contain an unauthenticated remote code execution vulnerability. This proof of concept submits a crafted XML deserialization payload to execute a command on an affected target. https://packetstorm.news/download/237649...
emqx-RCE
EMQX Dashboard - RCE This is a malicious plugin for EMQX Dashboard which allows to execute commands remotely. The code in this repository is mostly based on one of the latest releases of the EMQX plugin template repository, licensed under Apache 2.0. If you would like to give this a try, you can...
CVE-2018-17431-PoC
CVE-2018-17431-PoC Proof of consept for CVE-2018-17431 Exploit Title: Comodo Firewall & Central Manager UTM All Release before 2.7.0 & 1.5.0 Remote Command Execution Web Shell based Exploit Author: Milad Fadavvi Vendor Homepage: https://www.comodo.com/ Software Link:...
Gorsair
Gorsair Gorsair is a penetration testing tool for discovering and remotely accessing Docker APIs from vulnerable Docker containers. Once it has access to the docker daemon, you can use Gorsair to directly execute commands on remote containers. Exposing the docker API on the internet is a tremendo...
CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass
CVE-2019-6340 / SA-CORE-2019-003 Three scripts included to demonstrate how Drupal 8.6.9 is vulnerable to CVE-2019-6340: createnodeviarest.py - Example of normal authenticated node create with REST API doesnotcorrespond.py - Proving the request is processed even without authentication exploit.py -...
Amazon Linux 2 : lrzsz (ALAS-2026-4031)
The version of lrzsz installed on the remote host is prior to 0.12.20-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4031 advisory. lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote sende...
EUVD-2026-108610
Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router...
CVE-2026-79891
This vulnerability involves an unauthenticated buffer overflow in AOS-8 that can lead to Remote Code Execution (RCE) . While specific software versions and root causes are not detailed in the provided documents, the impact includes high severity across confidentiality, integrity, and availability...
CVE-2026-79887 Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)
A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of connected systems...
CVE-2026-79887 Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)
A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of connected systems...
Exploit for Authentication Bypass by Spoofing in Ivanti Connect_Secure
Bluefire Redteam — Ivanti Connect Secure check Checker only...
PT-2026-121584
Name of the Vulnerable Software and Affected Versions AOS-10 affected versions not specified Description Authentication bypass flaws in the affected interface could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying operating system if specific preconditions...
PT-2026-121628
Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description Multiple web interface endpoints in AOS-8 devices are susceptible to a buffer overflow when processing specially crafted requests. This flaw allows an unauthenticated remote attacker to execute...