Drupal-Exploit-Lab

Drupal-Exploit-Lab Demonstration on exploitation on Drupal 7.57 CVE-2018-7600 with and without WAFWeb Application Firewall Description The project shows how the exploitation of Drupal 7.57 looks like in two different scenarios: 1. Unprotected server → successful exploitation with Metasploit and...

CVE-2026-114278

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

EUVD-2026-112026

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

CVE-2026-114278 Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

CVE-2026-114278 Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

CVE-2026-114278

The che-machine-exec service is vulnerable to unauthenticated command injection because it constructs shell commands by concatenating user-controlled input from the /exec/init and /exec/config JSON endpoints without proper escaping. Specifically, the username and namespace fields are inserted int...

CVE-2023-26035

POC for CVE-2023-26035 Works for ZoneMinder Versions prior to 1.36.33 and 1.37.33 Vulnerability : Remote Code Execution RCE Usage └─➜ python3 poc.py -h usage: poc.py -h --target TARGET --cmd CMD poc.py: error: the following arguments are required: --target, --cmd Curl Before jumping to rev shell,...

AndroBugs_Framework

AndroBugs Framework AndroBugs Framework is an Android vulnerability analysis system that helps developers or hackers find potential security vulnerabilities in Android applications. No splendid GUI interface, but the most efficient less than 2 minutes per scan in average and more accurate. Versio...

smb-usermap

Samba "username map script" Command Execution This module exploits a command execution vulnerability in Samba versions 3.0.20 through 3.0.25rc3 when using the non-default "username map script" configuration option. By specifying a username containing shell meta characters, attackers can execute...

PT-2026-128212

Name of the Vulnerable Software and Affected Versions Eclipse Che che-machine-exec affected versions not specified Description The che-machine-exec service is subject to OS command injection. The service constructs shell commands by concatenating user-controlled input into a double-quoted sh -c...

CVE-2026-118755: Volmarg personal-management-system: Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows…

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell...

CVE-2026-57203

The Asterisk telephony toolkit is vulnerable to local privilege escalation due to a CWE-426 untrusted search path issue. In versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 , and Certified Asterisk 20.7-cert11, 22.8-cert3 , the ast_loggrabber component executes a Python script from the world-w...

spinnaker-poc

Spinnaker Vulnerability POCs Proof-of-concept demonstrations for CVE-2026-32604 and CVE-2026-32613, two 10.0 severity vulnerabilities in Spinnaker that allow for code execution and production cloud credential theft. Video walkthrough of how to use these POCS Technical blog with more details...

CVE-2019-16759

CVE-2019-16759 vBulletin 5.x Unauthorized RCE Batch Detection Script This vulnerability is quite trivial; out of 200+ random targets, only 5 had it. Now handle it yourself—you already have PHP, how can you not get a reverse shell?...

EUVD-2026-111231

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

CVE-2026-117569

Kali-GPT through commit a608c74 contains an OS command injection vulnerability in executetool in kaligpt/tools/mcpserver.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target,...

CVE-2026-117573

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagentarduino and hagentesp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated...

CVE-2026-117560

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $ or backtick substitutions into parameters...

CVE-2026-117559

DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $... or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.runshell or...

core-admin escape_param shell injection (bytecode sink)

Loads product security.pyc/command.pyc to craft shell metacharacters for configured sink templates local bytecode lab; use product UI/API on target. """core-admin — Systemic Shell Command Injection via Ineffective Quote Escaping → Authenticated Root RCE""" from future import annotations from...