Nuclei-Template-Exploit-F5-BIG-IP-iControl-REST-Auth-Bypass-RCE-Command-Parameter

Nuclei Template Exploit F5 BIG-IP iControl REST Auth Bypass RCE | Command Parameter CVE-2022-1388 is an authentication bypass vulnerability in the REST component of BIG-IP’s iControl API that was assigned a CVSSv3 score of 9.8. The iControl REST API is used for the management and configuration of...

CVE-2020-11984

快速开始 docker build --no-cache -t cve-2020-11984 . docker run --rm -it -p 8080:80 --name cve-2020-11984 cve-2020-11984 pipenv run python3 exploit.py -u localhost:8080/ -c "echo 111/tmp/abc" 参考 https://github.com/RubenBar/MLW-upcrans/...

Struts2-048

Struts2-048 CVE-2017-9791 Author: DragonEgg def Usage: print 'check:' print ' python file.py http://1.1.1.1/struts2-showcase/integration/saveGangster.action' print 'poc:' print ' python file.py http://1.1.1.1/struts2-showcase/integration/saveGangster.action command' Demo...

CVE-2022-26134

CVE-2022-26134 Uso: exploit.py url comando...

CVE-2015-1427

CVE-2015-1427 参数 -u 单个url -l 指定url文件 -c 指定命令...

PT-2026-73378

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

CVE-2026-13059

Technical details are not publicly available in the provided documents. No specific affected products, versions, or exploit vectors are stated here. Monitor for updates as new information may emerge.

Security update for mariadb

This update for mariadb fixes the following issues: CVE-2026-3494: audit plugin comment handling bypass bsc1259176. CVE-2026-34303: mysql: optimizer unspecified vulnerability bsc1266435. CVE-2026-44168: wsrep SST unsafe parameter handling on the donor side bsc1266442. CVE-2026-44170: argument...

TRENDnet TEW-432BRP 命令注入漏洞

TRENDnet TEW-432BRP is a dual-band wireless router produced by the TRENDnet company. The TRENDnet TEW-432BRP 3.10B20 version has a command injection vulnerability. This vulnerability stems from the parameter sysCmd in the formSysCmd function within the goform/formSysCmd file, which allows for...

GHSA-HXMH-2XC4-C894 Dolibarr ERP CRM contains a remote code evaluation vulnerability

Dolibarr ERP CRM 7.0.3 contains a remote code evaluation vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the dbname parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the dbname parameter, then...

The vulnerability of the mp function in the goform/mp component of the webs microprogramming system for wireless signal amplifiers from Edimax EW-7438RPn allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the mp function in the goform/mp component of the webs microprogramming system for wireless signal amplifiers from Edimax EW-7438RPn is related to an out-of-buffer operation in memory when processing the command parameter. Exploiting this vulnerability allows a remote attacke...

CVE-2018-25357

Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the dbname parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the dbname parameter, then...

PT-2026-43096

Name of the Vulnerable Software and Affected Versions Dolibarr ERP CRM version 7.0.3 Description Unauthenticated attackers can achieve remote code execution by injecting PHP code through the db name parameter. This is performed by sending a POST request to the 'install/step1.php' endpoint...

CVE-2026-30352: Improper Neutralization of Special Elements used in a Command

A remote code execution RCE vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter...

CVE-2026-30352

A remote code execution RCE vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter...

CVE-2026-30352

A remote code execution RCE vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter...

Summarization Functions 操作系统命令注入漏洞

Summarization Functions is an intelligent text summarization server developed by Braffolk’s individual developer. Versions of Summarization Functions prior to 0.1.5 had a vulnerability related to operating system command injection. This vulnerability stemmed from improper handling of the command...

PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()

Summary The --mcp CLI argument is passed directly to shlex.split and forwarded through the call chain to anyio.openprocess with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command execution as the process user. Details cli/features/mcp.py:61 source -...

CVE-2017-20222

Telesquare SKT LTE Router SDT-CS3B1 software version 1.2.0 contains an unauthenticated remote reboot vulnerability that allows attackers to trigger device reboot without authentication. Attackers can send POST requests to the lte.cgi endpoint with the Command=Reboot parameter to cause denial of...

CVE-2026-23814

A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior...