CVE-2025-3248

中文 ｜ English Langflow Vulnerability Scanner A vulnerability scanner for CVE-2025-3248 in Langflow applications. Features Scan single target or multiple targets using FOFA Execute system commands on vulnerable targets Retrieve system information Custom payload support Progress bar for FOFA scannin...

CVE-2019-9193

EN GenPostgresRCEExploit is a PoC tool designed to exploit an authenticated Remote Code Execution RCE vulnerability in specific versions of PostgreSQL 9.3 - 11.7. It allows authenticated users to execute system commands on a PostgreSQL database server that is vulnerable to CVE-2019-9193. Features...

Web-Check < 2.0.1 Screenshot API - OS Command Injection

Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters. id: CVE-2025-32778 info: name: Web-Check 2.0.1 Screenshot API - OS Command Injection author:...

freeswitch_rce

version: !1https://assets.kitploit.com/production/public/readmes/26769/65a2d4b4b9b040b96740cd66aee81ea...

CVE-2021-41773

CVE-2021-41773 - Remote Code Execution in Apache 2.4.49 PoC for CVE-2021-41773 as I just found over-complicated exploits and this one goes straight to the Remote Code Execution. Usage Just specify the IP address running the vulnerable Apache 2.4.49 server with -i and the desired system command wi...

CVE-2024-7954

CVE-2024-7954 This exploit will attempt to execute system commands on SPIP targets CVE-2024-7954. Overview This is a bulk scanning and exploitation tool for CVE-2024-7954: SPIP 4.2.8 allows unauthenticated attackers to launch RCE on SPIP targets. This tool is based on this Security Research. How ...

gdog

Gdog A stealthy Python based Windows backdoor that uses Gmail as a command and control server This project was inspired by the gcathttps://github.com/byt3bl33d3r/gcat from byt3bl33d3r. Requirements Python 2.x PyCrypto module WMI module Enum34 module Netifaces module Features Encrypted...

CVE-2019-9193

EN GenPostgresRCEExploit is a PoC tool designed to exploit an authenticated Remote Code Execution RCE vulnerability in certain versions of PostgreSQL 9.3 - 11.7. It allows authenticated users to execute system commands on a PostgreSQL database server vulnerable to CVE-2019-9193. Features...

CVE-2026-115547

An input validation issue in the Okta Access Gateway OAG Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account...

EUVD-2026-107032

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPXUpdateEngine::unserializeTest during migration. This allows unauthenticate...

CVE-2026-82814 Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPXUpdateEngine::unserializeTest during migration. This allows unauthenticate...

CVE-2026-82814

The Duplicator and Duplicator Pro plugins for WordPress (versions up to 1.5.17 and 4.6.10 , respectively) are vulnerable to unauthenticated PHP Object Injection . The root cause is the unsafe deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during a migration....

cve-2019-9978

cve-2019-9978 This is a script that allows exploiting the CVE-2019-9978 vulnerability in a straightforward manner, intended for use in Capture The Flag CTF challenges or as a proof of concept for penetration testing. Prerequisites Python 3 Requests library Install with pip install requests Usage ...

EUVD-2026-95100

Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the...

CLEANSTART-2026-JU40621 attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container

Security vulnerability affects the apache-hive package. An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container...

PT-2026-108042

Name of the Vulnerable Software and Affected Versions Obsidian Desktop versions prior to 1.14.0 Description Insufficient sanitization of the data-background-iframe attribute allows the bypass of DOMPurify. This issue is processed by the bundled Reveal.js 4.3.1 within the Slides core plugin,...

PT-2026-106708

Name of the Vulnerable Software and Affected Versions Craft CMS version 5.10.13.2 Description An authenticated remote code execution issue exists in the Control Panel action 'app/render-components'. Users with basic Control Panel access can submit request-controlled component classes and property...

PT-2026-98268

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...

ROS-20260924-73-0001

The vulnerability in Dracut is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-93922: Improper Neutralization of Input During Web Page Generation

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens,...