PT-2026-135495

Control Web Panel CWP before webpanel version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

CVE-2026-104080: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API…

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...

VulnCheck KEV: CVE-2026-47670

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint...

PT-2026-135667

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...

PT-2026-135427

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently...

CentOS Linux 7 [TuxCare] Security Update: flatpak / flatpak-builder / flatpak-devel / flatpak-libs (CENTOS7:CLSA-2026:1793185511)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793185511 advisory. - A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via...

needrestart Sudo Privilege Escalation

needrestart before version 3.8 allows local attackers to execute arbitrary code as root by causing it to run Python with an attacker-controlled PYTHONPATH environment variable. This proof of concept creates a privileged shell on the affected target. https://packetstorm.news/download/238915...

CVE-2026-111560: Barracuda Networks: Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance…

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently...

PT-2026-135493

Control Web Panel CWP before webpanel version 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

PT-2026-135664

The pppoe wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X Amlogic S905/S905X TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AF UNIX datagram socket...

PT-2026-135492

Control Web Panel CWP before webpanel version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/,...

cve-2025-32433

Build » git clone https://github.com/0xPThree/cve-2025-32433.git && cd cve-2025-32433 » docker build -t erlang-ssh . » docker run -d --name erlang-ssh -p 2222:2222 erlang-ssh POC kdev :: /erlang/CVE-2025-32433 ‹main› » python3 cve-2025-32433.py -h usage: cve-2025-32433.py -h -d --host HOST --port...

Ivanti Sentry MICSLog RCE (CVE-2023-38035)

Horizon3: unauthenticated Hessian uploadFileUsingFileInput on /mics/services/MICSLogService with root command execution. Uses framework HTTP/Hessian client proxy-aware. CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2023-38035 — Ivanti Sentry MICSLogService Hessian command injecti...

Exploit for CVE-2026-9151

CVE-2026-9151 Authenticated OS command injection in the Arche...

EPScalate

EPScalate An elevation of privilege vulnerability in QuickHeal's Seqrite Enterprise Endpoint Security Solution EPS. The vulnerability has been assigned a CVE ID of CVE-2023-31497. https://user-images.githubusercontent.com/39941993/230790056-87157751-b96c-49a6-81df-bf3126acfbd6.mp4 Vendor and...

dirty-pipe

Dirty Pipe - CVE-2022-0847 This is simply the code and instructions for how to use Max Kellermann's exploit for CVE-2022-0847 known as Dirty Pipe. Please go to https://dirtypipe.cm4all.com/ to read more about how to exploit works! How to use 1. Download and compile the exploit binary git clone...

Exploit for CVE-2026-98260

CVE-2026-98260 Timer LPE — OPPO Pad Air 5 OPD2501 / MT6878 P...

CVE-2023-28432

CVE-2023-28432 CVE-2023-28432 Minio Information Disclosure Exploit Usage Write url into urls.txt, then directly run python CVE-2023-28432.py Compatible formats: http://ip:port, ip:port python CVE-2023-28432.py ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ █████╗ ██╗ ██╗██████╗...

ediop3PHP

ediop3PHP A PHP CVE-2025-1219 SCANNER. In bash no root...

CVE-2024-25832-PoC

CVE-2024-25830 and CVE-2024-25832 - DataCube3 Improper Access Control and Unrestricted File Upload. Overview This repository features a Proof of Concept PoC for a two-step exploit chain targeting DataCube3 devices. It combines CVE-2024-25830 Improper Access Control to extract root passwords and...