CVE-2024-7954

CVE-2024-7954 This exploit will attempt to execute system commands on SPIP targets CVE-2024-7954. Overview This is a bulk scanning and exploitation tool for CVE-2024-7954: SPIP 4.2.8 allows unauthenticated attackers to launch RCE on SPIP targets. This tool is based on this Security Research. How ...

gdog

Gdog A stealthy Python based Windows backdoor that uses Gmail as a command and control server This project was inspired by the gcathttps://github.com/byt3bl33d3r/gcat from byt3bl33d3r. Requirements Python 2.x PyCrypto module WMI module Enum34 module Netifaces module Features Encrypted...

freeswitch_rce

version: !1https://assets.kitploit.com/production/public/readmes/26769/65a2d4b4b9b040...

CVE-2019-9193

EN GenPostgresRCEExploit is a PoC tool designed to exploit an authenticated Remote Code Execution RCE vulnerability in certain versions of PostgreSQL 9.3 - 11.7. It allows authenticated users to execute system commands on a PostgreSQL database server vulnerable to CVE-2019-9193. Features...

CVE-2019-9193

GenPostgresRCEExploit es una herramienta PoC diseñada para explotar una vulnerabilidad de Ejecución Remota de Código RCE autenticada en versiones específicas de PostgreSQL 9.3 - 11.7. Permite a usuarios autenticados ejecutar comandos del sistema en un servidor de base de datos PostgreSQL que sea...

CVE-2025-3248

中文 ｜ English Langflow Vulnerability Scanner A vulnerability scanner for CVE-2025-3248 in Langflow applications. Features Scan single target or multiple targets using FOFA Execute system commands on vulnerable targets Retrieve system information Custom payload support Progress bar for FOFA scannin...

Web-Check < 2.0.1 Screenshot API - OS Command Injection

Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters. id: CVE-2025-32778 info: name: Web-Check 2.0.1 Screenshot API - OS Command Injection author:...

CVE-2021-41773

CVE-2021-41773 - Remote Code Execution in Apache 2.4.49 PoC for CVE-2021-41773 as I just found over-complicated exploits and this one goes straight to the Remote Code Execution. Usage Just specify the IP address running the vulnerable Apache 2.4.49 server with -i and the desired system command wi...

cve-2019-9978

cve-2019-9978 This is a script that allows exploiting the CVE-2019-9978 vulnerability in a straightforward manner, intended for use in Capture The Flag CTF challenges or as a proof of concept for penetration testing. Prerequisites Python 3 Requests library Install with pip install requests Usage ...

EUVD-2026-68298

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the atta...

CVE-2026-82595

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the atta...

CVE-2026-58115

CVE-2026-58115 affects Siemens SIMATIC IoT2050 Advanced devices (6ES7647-0BA00-1YA2) running Industrial OS with Node-RED. All versions

EUVD-2026-55621

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026...

CVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

CVE-2026-66297 Unescaped deployment environment variables in generated setup commands

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

CVE-2026-71284

The CVE-2026-71284 issue affects Fledge’s backup-restore upload handler (upload_backup) in python/fledge/services/core/api/backup_restore.py. The handler takes the first extracted tar member’s filename and builds a shell command via string formatting: cmd = "cp {} {}". Since only a prefix/suffix ...

CVE-2026-71243

The CVE-2026-71243 entry concerns the backmeup npm package. It vulnerably assembles shell command strings by concatenating option values (name, source, destination, filter) into a single command (e.g., mkdir -p ...; ) and executes via a shell (ssh2-exec or local child_process), instead of using a...

CVE-2026-7693

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the file POST parameter on the restoreBackup AJAX handler. The handler applies escattr — an HTML-context sanitizer that does not strip...

EUVD-2026-52416

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portallogin of the component Login Endpoint. This manipulation causes os command...

CVE-2026-67608

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in actionaudio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec call...