CVE-2024-7954

CVE-2024-7954 このエクスプロイトは、SPIP ターゲット CVE-2024-7954 に対してシステムコマンドの実行を試みます。 概要 これは CVE-2024-7954 用の一括スキャンおよび悪用ツールです。SPIP 4.2.8 では、認証されていない攻撃者が SPIP ターゲット上で RCE を実行できます。このツールは、こちらの セキュリティ研究 に基づいています。 使い方 スクリプトの依存関係をインストール: root@kitploit: pip install -r requirements.txt オプション: root@kitploit: POC for SP...

CVE-2019-9193

EN GenPostgresRCEExploit 是一个 PoC 工具，用于利用特定版本的 PostgreSQL（9.3 - 11.7）中存在的经过身份验证的远程代码执行（RCE）漏洞。它允许经过身份验证的用户在存在 CVE-2019-9193 漏洞的 PostgreSQL 数据库服务器上执行系统命令。 功能特性 RCE 利用 ：通过经过身份验证的 PostgreSQL 会话执行系统命令。 版本检查 ：检查目标 PostgreSQL 服务器的版本，以确认是否存在漏洞。 命令执行 ：允许用户在存在漏洞的服务器上执行命令。 自动表管理 ：自动创建和删除临时表以执行命令，无需手动干预。 依赖要...

CVE-2019-9193

GenPostgresRCEExploit es una herramienta PoC diseñada para explotar una vulnerabilidad de Ejecución Remota de Código RCE autenticada en versiones específicas de PostgreSQL 9.3 - 11.7. Permite a usuarios autenticados ejecutar comandos del sistema en un servidor de base de datos PostgreSQL que sea...

CVE-2025-3248

English | 中文 Langflow 漏洞扫描器 用于扫描 Langflow 应用中 CVE-2025-3248 漏洞的工具。 功能特点 支持单目标扫描或使用 FOFA 批量扫描 在存在漏洞的目标上执行系统命令 获取系统信息 支持自定义 payload FOFA 扫描进度条显示 美观的命令行界面 安装方法 1. 克隆仓库： root@kitploit: git clone https://github.com/xuemian168/CVE-2025-3248.git cd CVE-2025-3248/ 2. 安装依赖： root@kitploit: python3 -m venv...

PT-2026-88938

Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potential...

EUVD-2026-68298

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the atta...

CVE-2026-82595

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the atta...

CVE-2026-58115

CVE-2026-58115 affects Siemens SIMATIC IoT2050 Advanced devices (6ES7647-0BA00-1YA2) running Industrial OS with Node-RED. All versions

PT-2026-62103

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An issue exists in the audit file upload functionality where a filename provided during the upload process is not properly sanitized before being used in system...

PYSEC-2026-471 PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()

Summary The --mcp CLI argument is passed directly to shlex.split and forwarded through the call chain to anyio.openprocess with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command execution as the process user. Details cli/features/mcp.py:61 source -...

CVE-2021-47952

python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during...

GHSA-4PVG-PRR3-9CXR Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore

Product: nginx-ui Repository: 0xJacky/nginx-ui branch: dev Vulnerability Class: Authentication Bypass → Arbitrary File Write → OS Command Injection Affected Component: POST /api/restore --- 1. Vulnerability Summary nginx-ui exposes a backup restore endpoint POST /api/restore that is completely...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the filter parameter in multiple endpoints, leveraging the MongoLite $func operator. An attacker can execute arbitrary system commands by supplying crafted input to the affected endpoints. Remediation Upgrad...

CVE-2026-31019

In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code...

CVE-2025-15101

An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrary system commands via a crafted parameter. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisor...

CVE-2017-20221 Telesquare SKT LTE Router SDT-CS3B1 CSRF System Command Execution

Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0 contains a cross-site request forgery vulnerability that allows authenticated attackers to execute arbitrary system commands by exploiting missing request validation. Attackers can craft malicious web pages that perform administrative actions when...

📄 F5 BIG-IP TMUI Unauthenticated Remote Code Execution

This Metasploit module exploits a directory traversal vulnerability in the F5 BIG-IP TMUI interface that allows unauthenticated attackers to execute arbitrary system commands via tmshCmd.jsp...

CVE-2026-26216

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec. The import builtin was included in the allowed builtins, allowing unauthenticated remote...

CVE-2026-25049

n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. This issue h...

CVE-2026-25134 Group-Office Argument Injection in MaintenanceController::actionZipLanguage

Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an action zipLanguage which takes a lang parameter and passes it directly to a system zip command via exec. This can be combined with uploadi...