Lucene search
+L

32212 matches found

RedhatCVE
RedhatCVE
added 5 hours ago4 views

CVE-2026-17347

A flaw was found in pgAdmin 4. The MASTERPASSWORDHOOK setting, which allows administrators to configure an external command for per-user encryption keys, improperly substitutes usernames into the command string. An authenticated user can exploit this by providing a specially crafted username...

7.7CVSS5.9AI score0.00267EPSS
SaveExploits0References2
Nuclei
Nuclei
added 16 hours ago15 views

Pinger 1.0 - Remote Code Execution

Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters. id:...

9.8CVSS6.6AI score0.03135EPSS
SaveExploits0References2
Nuclei
Nuclei
added 16 hours ago125 views

Apache Spark UI - Remote Command Injection

Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilte...

8.8CVSS8.1AI score0.93076EPSS
SaveExploits12References5
Nuclei
Nuclei
added 16 hours ago138 views

Viessmann Vitogate 300 - Remote Code Execution

In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method. id: CVE-2023-45852 info: name: Viessmann Vitogate 300 - Remote Code Execution autho...

9.8CVSS7.3AI score0.14003EPSS
SaveExploits1References5
Nuclei
Nuclei
added 16 hours ago101 views

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the addModifyZTDProxy function in NmsController. The function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by...

10CVSS7.8AI score0.42551EPSS
SaveExploits1References3
Nuclei
Nuclei
added 16 hours ago83 views

Citrix SD-WAN Center - Remote Command Injection

Citrix SD-WAN Center is susceptible to remote command injection via the ping function in DiagnosticsController, which does not sufficiently validate or sanitize HTTP request parameter values used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through t...

10CVSS7.8AI score0.39544EPSS
SaveExploits1References3
Nuclei
Nuclei
added 16 hours ago86 views

Websvn <2.6.1 - Remote Code Execution

WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter. id: CVE-2021-32305 info: name: Websvn 2.6.1 - Remote Code Execution author: gy741 severity: critical description: WebSVN before 2.6.1 allows remote attackers to execute...

10CVSS8.2AI score0.86716EPSS
SaveExploits9References5
Nuclei
Nuclei
added 16 hours ago75 views

Apache Spark - Authentication Bypass

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

9.8CVSS7.2AI score0.29157EPSS
SaveExploits0References2
Packet Storm News
Packet Storm News
added 20 hours ago2 views

Joern 4.0.594

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

5.5AI score
SaveExploits0
NVD
NVD
added 2 days ago5 views

CVE-2026-67308

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

9.3CVSS0.00561EPSS
SaveExploits0References2
CVE
CVE
added 2 days ago45 views

CVE-2026-67308

Concretely documented CVE-2026-67308 affects Wazuh workflows prior to 44bf114. A shell injection exists in GitHub Actions workflows via fork pull requests that submit crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated in...

9.3CVSS6.2AI score0.00561EPSS
SaveExploits0References2
EUVD
EUVD
added 2 days ago9 views

EUVD-2026-51853

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

10CVSS6.2AI score0.00561EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2 days ago33 views

CVE-2026-67308 Wazuh GitHub Actions Shell Injection via Fork Pull Request

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

9.3CVSS0.00561EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2 days ago7 views

CVE-2026-67308

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

10CVSS6.2AI score0.00561EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2 days ago63 views

OpenDreambox 2.0.0 - Remote Code Execution

OpenDreambox 2.0.0 is susceptible to remote code execution via the webadmin plugin. Remote attackers can execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI in enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py. id: CVE-2017-14135 info: nam...

10CVSS8.8AI score0.21842EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2 days ago32 views

Enigma NMS < 65.0.0 - Authenticated OS Command Injection

An OS command injection vulnerability in the discoverandmanage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an authenticated attacker to execute arbitrary code because of improper neutralization of shell metacharacters in the ipaddress variable within an snmpbrowser action. id:...

10CVSS8.2AI score0.25279EPSS
SaveExploits5References3
OSV
OSV
added 3 days ago4 views

MAL-2026-11424 Malicious code in telerape (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21e8fc4f3dd969ec103ff1cb8a5bdba0d465bffffabe2615bc38d8e00606cffa Package places a reverse shell in the PTH file. In analyzed versions, the target was on localhost. --- Category: MALICIOUS - The campaign has clearly malicious...

5.8AI score
SaveExploits0References1
NVD
NVD
added 3 days ago8 views

CVE-2026-53599

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with mediaupload permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with...

7.5CVSS0.00314EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 3 days ago7 views

CVE-2026-53599

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with mediaupload permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with...

7.5CVSS5.6AI score0.00314EPSS
SaveExploits0References5Affected Software1
CVE
CVE
added 3 days ago15 views

CVE-2026-53599

CVE-2026-53599 affects REDAXO CMS versions 5.18.2–5.21.1 where rex_mediapool::isAllowedExtension lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg. On servers with multi-extension PHP handlers, this can be executed as the web serve...

7.5CVSS5.6AI score0.00314EPSS
SaveExploits0References4
Rows per page
Query Builder