goahead-webserver-pre-5.1.5-RCE-PoC-CVE-2021-42342-

Goahead webserver pre v5.1.5 RCE PoC CVE-2021-42342 A recent bug in Goahead Webserver was discovered by William Bowling which leads to RCE on the exploited server. The issue exists prior to version 5.1.5 which, according to Shodan covers around 2.8mio servers on the internet. A CVS is available n...

Shocker-TJNULL-OSCP-

HackTheBox: Shocker Writeup A structured and professional walkthrough showcasing the identification and manual exploitation of the critical Shellshock vulnerability, followed by local privilege escalation via misconfigured sudo rights on a Linux target. Technical Overview Target OS: Linux IP...

-CVE-2014-6271

root@kitploit: / || | | | | | | | / || | | |/ \ / | |/ / \ | || | | | | | | \ | || | | | | | | ' / | | || || | | | || | || . \ |/|| |||||/|| ||/ ||\ CVE-2014-6271 — Shellshock 通过Bash环境变量注入实现远程代码执行 "一个隐藏在Bash中数十年的缺陷，在不到24小时内撼动了互联网的根基。" 目录 什么是Shellshock？ 时间线 受影响系统 技术描述 PoC — 概念验证 攻击向量...

telnet_scan

Escáner de Vulnerabilidades Telnet CVE-2026-24061 & CVE-2026-32746 Una herramienta de evaluación de seguridad basada en Python que detecta y cuando corresponde explota dos vulnerabilidades críticas en GNU InetUtils telnetd: CVE-2026-24061 – Bypass de autenticación mediante inyección de la variabl...

CVE-2014-6271-Shellshock-

Exploiting Shellshock CVE-2014-6271: A Complete, Modern Demonstration Lab Shellshock CVE-2014-6271 is one of the most influential remote code execution vulnerabilities ever discovered. The flaw affects Bash and allows attackers to execute arbitrary commands simply by injecting crafted payloads in...

GNU-Inetutils-telnet-CVE-2026-24061-

CVE-2026-24061 Herramienta de Detección de Bypass de Autenticación en GNU Inetutils Telnetd 📋 Resumen del Proyecto Esta es una herramienta avanzada de detección para la vulnerabilidad de bypass de autenticación en GNU Inetutils Telnetd CVE-2026-24061. Esta vulnerabilidad tiene una puntuación CVSS...

CVE-2014-6271

CVE-2014-6271 Shellshock Python Exploit A clean, efficient, and interactive Python implementation designed to test for the Shellshock vulnerability CVE-2014-6271 via HTTP environment variable injection. 📝 Description Shellshock CVE-2014-6271 is a critical security vulnerability in the Bash shell...

CVE-2026-24061

Herramienta de detección masiva de la vulnerabilidad CVE-2026-24061 ⚠️ Nota : CVE-2026-24061 GNU Inetutils es un conjunto de herramientas de red clásicas proporcionado por el proyecto GNU, que incluye el servicio telnetd, es decir, el demonio del servidor Telnet. En las versiones 1.9.3 a 2.7, el...

CVE-2026-22015-Serverless-Function-Environment-Variable-Injection-via-Event

CVE-2026-22015 – Inyección de variables de entorno en funciones serverless a través del evento Código del programa simulación de Python Lambda root@kitploit: lambdaenvinject.py - Vulnerable function that reads env from event import os, json def handlerevent, context: The event contains environmen...

CVE-2026-12940-Langflow-Unauth-RCE

CVE-2026-12940 — Langflow OSS ≤ 1.10.1 RCE no autenticado inyección de variables de entorno en MCP stdio Ejecución remota de código no autenticada en Langflow OSS hasta 1.10.1. La lista negra de variables de entorno que protege la configuración del servidor MCP stdio DANGEROUSENVVARS omite...

CVE-2021-4034-pwnkit

CVE-2021-4034, PwnKit Proof of concept for PwnKit, a local privilege escalation in polkit's pkexec. On a default install any unprivileged local user can become root. About the bug Vulnerable versions of pkexec mishandle the process argument count. That lets controlled environment variables get...

CVE-2026-85431

MOOS essential-moos (through version 10.0.1 ) is vulnerable to an unauthenticated UDP packet injection in pMOOSBridge when configured with UDPListen. An attacker can send crafted UDP packets to the configured port to inject arbitrary variables into the local MOOS community, with spoofed source an...

CVE-2026-85431 MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet Injection

MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOSBridge when configured with UDPListen. Attackers can send crafted UDP packets to the configured port to inject arbitrary variables into the local MOOS community with spoofed source an...

PT-2026-85302

Name of the Vulnerable Software and Affected Versions MOOS core-moos versions prior to 10.4.1 Description MOOSDB HTTP pages fail to escape database contents during rendering, leading to stored cross-site scripting. This allows a MOOS publisher to set variable values containing malicious script...

CVE-2026-53541

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-18937

The Broken Link Checker plugin before 2.4.12 accepts unrestricted query variables on sites using plain permalinks, letting unauthenticated users overwrite arbitrary PHP globals and achieve remote code execution when a classic editor is active. CVSS 9.0 (Critical). No exploitation evidence is prov...

CVE-2026-18937 Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...

CVE-2026-12940

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

EUVD-2026-51240

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

CVE-2026-54364

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit th...