CVE-2024-7954

CVE-2024-7954 此漏洞利用程序将尝试在SPIP目标上执行系统命令CVE-2024-7954。 概述 这是一个针对CVE-2024-7954的批量扫描与利用工具：SPIP 4.2.8允许未经认证的攻击者在SPIP目标上执行远程代码执行。该工具基于此安全研究。 使用方法 安装脚本依赖： pip install -r requirements.txt 选项： POC for SPIP 4.2.8 vulnerability options: -h, --help show this help message and exit -u U Target URL, example...

CVE-2025-3248

中文 ｜ English Escáner de Vulnerabilidades Langflow Un escáner de vulnerabilidades para CVE-2025-3248 en aplicaciones Langflow. Características Escanear un solo objetivo o múltiples objetivos usando FOFA Ejecutar comandos del sistema en objetivos vulnerables Obtener información del sistema Soporte...

Web-Check < 2.0.1 Screenshot API - OS Command Injection

Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters. id: CVE-2025-32778 info: name: Web-Check 2.0.1 Screenshot API - OS Command Injection author:...

freeswitch_rce

version: 由于 freeswitch 通常以高权限运行，因此也可以实现权限提升的效果...

CVE-2019-9193

EN GenPostgresRCEExploit 是一个 PoC 工具，旨在利用特定版本 PostgreSQL（9.3 - 11.7）中经过身份验证的远程代码执行（RCE）漏洞。它允许已认证用户在存在 CVE-2019-9193 漏洞的 PostgreSQL 数据库服务器上执行系统命令。 功能特性 RCE 漏洞利用 ：通过已认证的 PostgreSQL 会话执行系统命令。 版本检查 ：验证目标 PostgreSQL 服务器的版本，以确认是否存在该漏洞。 命令执行 ：如果服务器存在漏洞，则允许在服务器上执行自定义命令。 自动表管理 ：自动创建和删除用于命令执行的临时表，无需手动干预。 环境...

gdog

Gdog A stealthy Python based Windows backdoor that uses Gmail as a command and control server This project was inspired by the gcathttps://github.com/byt3bl33d3r/gcat from byt3bl33d3r. Requirements Python 2.x PyCrypto module WMI module Enum34 module Netifaces module Features Encrypted...

CVE-2021-41773

CVE-2021-41773 - Apache 2.4.49 中的远程代码执行 针对 CVE-2021-41773 的 PoC，因为我发现很多利用方式过于复杂，而这个工具可以直接实现远程代码执行。 用法 只需使用 -i 指定运行存在漏洞的 Apache 2.4.49 服务器的 IP 地址，并使用 -c 指定所需的系统命令。如果 Web 服务器未运行在端口 80 上，我们可以使用 -p 指定它；如果 Web 服务器使用 HTTPs，则需要使用 --use-https 标志。 $ python3 CVE-2021-41773.py -i 10.10.10.10 -c 'id' $ pytho...

CVE-2019-9193

EN GenPostgresRCEExploit is a PoC tool designed to exploit an authenticated Remote Code Execution RCE vulnerability in certain versions of PostgreSQL 9.3 - 11.7. It allows authenticated users to execute system commands on a PostgreSQL database server vulnerable to CVE-2019-9193. Features...

cve-2019-9978

cve-2019-9978 このスクリプトは、CVE-2019-9978の脆弱性を簡単に悪用できるように設計されており、Capture The Flag CTF チャレンジやペネトレーションテストの概念実証として使用することを目的としています。 前提条件 Python 3 Requestsライブラリ pip install requests でインストール 使用方法 1. このリポジトリをクローンまたはダウンロードします。 2. ターミナルを開き、スクリプトのディレクトリに移動します。 3. 以下のオプションを使用してスクリプトを実行します： ./cve-2019-9978.py -u...

PT-2026-98268

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...

ROS-20260924-73-0001

The vulnerability in Dracut is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-93922: Improper Neutralization of Input During Web Page Generation

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens,...

CVE-2026-61817

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance, showpartitions, showpartitioninfo, undopartition, and partitiondatatime interpolate the writable partconfig.timedncoder text value without identifier quoting into dynamic SQL. A role...

PT-2026-95646

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description The extension manages partitioned tables by time or ID. The functions run maintenance, show partitions, show partition info, undo partition, and partition data time interpolate the writable part...

CVE-2026-53534 JabRef CAYW Sublime Text integration permits operating-system command injection

JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...

CVE-2026-68070

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

CVE-2026-68070 Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

EUVD-2026-79949

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

CVE-2026-68070 Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

CVE-2026-68070: Missing Authentication for Critical Function

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...