42835 matches found
CVE-2026-101947 ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export
ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...
dirtycow-vdso
0xdeadbeef PoC para Dirty COW CVE-2016-5195. Este PoC se basa en ptrace en lugar de /proc/self/mem para parchear vDSO. Tiene algunas ventajas sobre los PoCs que modifican binarios del sistema de archivos: no requiere un binario setuid bypass de SELinux escape de contenedores sin caída del kernel...
CLEANSTART-2026-VG90547 shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token
Security vulnerability affects the n8n package. shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token...
CVE-2026-101947: Improper Neutralization of Special Elements used in an OS Command
ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...
WordPress Bricksforge 3.1.8.9 Shell Upload
WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability in the temporaryFileUploads parameter. The proof of concept uploads a GIF/PHP polyglot, writes it with a .php extension, and verifies command execution...
PT-2026-117880
Security vulnerability affects the n8n package. shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token...
zip-shotgun
ZIP Shotgun Script utility per testare la funzionalità di upload di file zip e la possibile estrazione di file zip per vulnerabilità alias Zip Slip. L'idea per questo script proviene da questo post su Silent Signal Techblog - Compressed File Upload And Command Execution e da OWASP - Test Upload o...
CLSA-2026-1791584881 TuxCare security update for shell-quote (1 CVE)
TuxCare rebuilt shell-quote to address 1 CVE. Fixed in 1.8.3-tuxcare.2...
Malicious Package
Overview @library-wide/library-shell is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
CLSA-2026-1791563692 Fix CVE(s): CVE-2021-45463
SECURITY UPDATE: shell command injection via the image path - debian/patches/CVE-2021-45463.patch: run convert with gspawnsync instead of system in loadcache operations/common/magick-load.c - CVE-2021-45463...
CVE-2026-107814
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...
EUVD-2026-95887
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted...
Exploit for Unrestricted Upload of File with Dangerous Type in Monstra
CVE-2024-36774 — Monstra CMS 3.0.4 Remote Code Execution RCE...
CVE-2026-94503
Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...
CVE-2026-94503 WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...
EUVD-2026-95633
Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...
CVE-2026-94503
The PX-lab Zombify WordPress plugin (versions n/a through 1.7.7 ) is vulnerable to an Unrestricted Upload of File with Dangerous Type (CWE-434). This vulnerability allows an attacker to upload a web shell to the web server, potentially leading to unauthorized access and control. No specific remed...
CVE-2026-94503 WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...
CVE-2026-102422
A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...