ncrack

ncrack Ncrack is a high-speed network authentication cracking tool. It was built to help companies secure their networks by proactively testing all their hosts and networking devices for poor passwords. Security professionals also rely on Ncrack when auditing their clients. Ncrack was designed...

CVE-2020-17530

OGNL Injection Exploit Summary Simple Python script to exploit OGNL injection vulnerabilities in Apache Struts2/Tomcat and execute system commands. Usage pip install requests colorama python3 exploit.py -u http://target/index.action -c "id"...

CVE-2020-12641

CVE-2020-12641: Command Injection via “imconvertpath” Parameter in Roundcube Webmail A Command Injection vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. Because the "imconvertpath" does not perform sanitization/input filtering, an attacker with access to the Roundcube...

CVE-2026-61567

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-115904

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks routine in utils.js. An attacker who controls a target URL can...

CVE-2026-115904 Topluyo Desktop for Linux has an OS Command Injection issue

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks routine in utils.js. An attacker who controls a target URL can...

CVE-2026-115904 Topluyo Desktop for Linux has an OS Command Injection issue

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks routine in utils.js. An attacker who controls a target URL can...

CVE-2026-112197

Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The...

CVE-2026-112197 Missing Authentication for Critical Function in Tactis' NoviGest Desktop App

Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The...

EUVD-2026-111991

Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The...

PT-2026-128066

Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The...

CVE-2026-61567: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

Tactis NoviGest Desktop App authorization issue vulnerability

Versions of the Tactis NoviGest Desktop App prior to 8.0.0-300 contain an authorization issue vulnerability. This vulnerability stems from a lack of authentication for critical functions within the Java RMI service. Attackers with network access can invoke remote methods without authentication,...

convoC2

convoC2 Table of Contents Introduction Demo Usage Requirements Inspiration Contribute Introduction Command and Control infrastructure that allows Red Teamers to execute system commands on compromised hosts through Microsoft Teams. It infiltrates data into hidden span tags in Microsoft Teams...

CVE-2026-13162

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting th...

CVE-2026-13162

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting th...

CVE-2026-13162

An OS command vulnerability exists in the CoreTec product within the configuration daemon's time synchronization handler , which manages system time-zone settings. The flaw occurs because the daemon constructs shell commands by concatenating user-supplied input without sufficient sanitization or ...

PT-2026-126390

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting th...

CVE-2026-59106 Unauthenticated RCE Vulnerability in WolfProt interface implementation

A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected...

CVE-2026-59106 Unauthenticated RCE Vulnerability in WolfProt interface implementation

A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected...