WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read

WGDashboard = 4.2.3 contains a command injection caused by multiple OS command injection points, letting authenticated attackers execute arbitrary commands as root. id: CVE-2026-15733 info: name: WGDashboard = 4.3.2 - Authenticated OS Command Injection /etc/passwd Read author: str4k3r,0xAkoko...

aapanel-ws-bypass

aaPanel: Vendors Don't Always Fix Things Properly An incomplete fix for CVE-2021-37840 still exposes 3.6M servers to root RCE, 5 years later Discovered by: EON Security CVE: Pending assignment CVSS: 8.8 High — AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected: aaPanel versions 6.8.12 through 7.65.0...

CVE-2026-76461

⚡ CVE-2026-76461 - Inyección SQL Crítica...

Cisco-ASA-vulnerability-research

LINAFULLRE — 对 lina 的全覆盖逆向工程 创建时间： 2026-08-12 目标： labasav9-12-4-67/lina（ASAv 9.12467，ELF x86-64，PIE；Ghidra 映像基址 0x100000；112,687 个函数 ，映射约 167 MB，642,707 个符号） 轨道目标： 对 lina 二进制文件进行系统性、 完整 的逆向工程覆盖——以补充迄今已完成的假设驱动型定向逆向工程——从而猎取实验室尚未找到的原语（20362+20333 上现实世界中未认证 root RCE 已被证实，因此它必然存在）。 为何设立此轨道 此前所有逆向工程均为定...

CVE-2026-20079

CVE-2026-20079 Cisco Secure FMC PoC Python proof of concept for the publicly documented Cisco Secure Firewall Management Center authentication-bypass-to-root-RCE chain in CVE-2026-20079. This is not a new vulnerability or independently developed exploit chain. It is a clean-room implementation of...

CVE-2026-79916 MaxKB AWS Bedrock model credential injection leads to remote code execution

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...

tugtainer-1.30.2-CVE-2026-55494-and-CVE-2026-62308-to-RCE

Tugtainer v1.30.2 RCE The RCE is obtained by abusing 2 vulnerabilities CVE-2026-55494 CVE-2026-62308 In short, a SSRF vulnerability is abused to call to an unauthenticated service in the internal network to create a docker that shares the same pid with tugtainer, thus making the file system of th...

CVE-2026-65400-poc

CVE-2026-65400 — macOS 屏幕共享预认证 root 文件读取（只读 PoC） 只读概念验证。 它通过从易受攻击主机读取一个仅 root 可读的文件来演示认证绕过。 它不会向目标写入任何内容：不写入 LaunchDaemon、不写入 shell 启动文件、不写入 crontab、 不包含 RCE 利用链。 在本人自有的一台 Mac（macOS Tahoe 26.5.2，未打补丁）上运行。序列号已打码。 摘要 screensharingd —— 驱动 macOS 屏幕共享 / Apple 远程管理 （TCP 5900 ）的守护进程 ——...

CVE-2026-93958

D-Link R95 BE9500 Wi-Fi 7 Smart Router Vendor：D-Link Product：R95 Product Model：BE9500 Firmware Version：1.01B06 Vulnerability Type：Authenticated Command Injection Description El D-Link R95 BE9500 Wi-Fi 7 Smart Router versión de firmware BE95001.00.16 contiene una vulnerabilidad de inyección de...

CVE-2025-31644

CVE-2025-31644: Command Injection in Appliance mode in F5 BIG-IP The “file” parameter of the “save” command is vulnerable to a command injection attack, allowing an authenticated attacker with administrator privileges to the “/mgmt” web API or the SSH “tmsh” shell, to obtain remote code execution...

sendmail-clamav-exploit-CVE-2007-4560

Sendmail + ClamAV-Milter Exploit CVE-2007-4560 Python RCE exploit for Sendmail with ClamAV-Milter After successful exploitation: root@kitploit: nc 1001 bash -i Tested On Sendmail 8.13.4/8.13.4/Debian-3sarge3 ClamAV-Milter 0.91.2 References Orig...

CVE-2026-20079

🚨 CVE-2026-20079 "Critical Cisco FMC Zero-Day" Critical Authentication Bypass Leading to Root RCE in Cisco Secure Firewall Management Center 📋 Overview CVE-2026-20079 is a critical vulnerability in the web interface of Cisco Secure Firewall Management Center FMC Software. An unauthenticated remot...

CVE-2026-88533

CVE-2026-88533: Unauthenticated Arbitrary File Write → Root RCE in QAnything CVE ID : CVE-2026-88533 assigned by MITRE, record publication pending Product : QAnything by netease-youdao — open-source RAG / knowledge-base QA platform Affected : v1.4.x through v2.0.0 default branch qanything-v2,...

CVE-2026-34156

🚨 CVE-2026-34156 - NocoBase Critical Sandbox Escape Unauthenticated / Low-Privilege → Root Remote Code Execution in NocoBase 📌 Overview CVE-2026-34156 is a critical sandbox escape vulnerability in NocoBase an open-source no-code/low-code platform. An attacker with the ability to create or execute...

CVE-2026-52727

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine...

CVE-2026-90822

CVE-2026-90822 affects FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware 10.1.2r60p100 . An OS command injection in the xtremed daemon allows an unauthenticated remote attacker to submit crafted input to the AuthFormServlet endpoint on the management interface, causing au...

CVE-2026-67401

CVE-2026-67401 — Inyección SQL en EmailTrack de cPanel/WHM → RCE como root Prueba de concepto para CVE-2026-67401 , una vulnerabilidad crítica de inyección SQL en la funcionalidad EmailTrack de cPanel & WHM que permite a un usuario autenticado con privilegios relacionados con correo escribir...

cpanel-pwn

cpanel-pwn cPanel/WHM 安全测试工具包。实现了 CVE-2026-41940 CRLF 注入认证绕过及后渗透权限提升。 工具 脚本| 用途 ---|--- cpanelexploit.py| CVE-2026-41940：CRLF 注入 → WHM 认证绕过 → root 访问 CVE-2026-41940 类型： CRLF 注入 → 认证绕过 → Root RCE 影响范围： cPanel/WHM → 注入 hasroot=1，泄露 cpsess 令牌 阶段 3：GET /scripts2/listaccts → 触发会话缓存传播小工具 阶段 4：GET...

CVE-2026-67401-cPanel-EmailTrack-SQLi

CVE-2026-67401 — Inyección SQL en EmailTrack de cPanel y WHM → RCE como root Escáner de IOC, kit de detección y guía de remediación para la vulnerabilidad de inyección SQL en EmailTrack de cPanel Palabras clave: CVE-2026-67401, exploit cPanel, inyección SQL cPanel, vulnerabilidad WHM, SQLi...

CVE-2026-58147 Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers

WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the httppasswdhidden and httppasswdConfirmhidden parameters, allowing an authenticated attacker to...