shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

Impact quote emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input: js quote'echo', 'ok',...

NPM: shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

NPM: shell-quote: quote command injection via a line terminator in a token after a comment token vulnerability discovered by ? in WordPress Npm shell-quote versions = 1.8.4, 1.11.0...

CVE-2023-33246

CVE-2023-33246 CVE-2023-33246：Apache RocketMQ 远程命令执行漏洞检测工具 工具功能 简单使用 运行 ./apacherocketmqcve202333246scannerlinuxamd64 scan 输出 是否存在漏洞：是 或者 VulnFound: true 则说明存在漏洞，Version 或者 版本号 字段为工具检测到的资产的版本。 将检测数据输出到 json 文件 运行 apacherocketmqcve202333246scannerlinuxamd64 scan --output result.json...

CVE-2026-105841 lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

CVE-2026-105841

The lrzsz utility, in versions before 0.13.0 , is vulnerable to an OS command injection in the lrz receive utility's pipe mode. The root cause is located in src/lrz.c, where the procheader() function passes unescaped ZMODEM/YMODEM filenames to popen() when running under a suffixed name like lrzta...

CVE-2026-105841

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

CVE-2026-105841 lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

EUVD-2026-93393

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

CVE-2026-39949

CVE-2026-39949：通过主机变量注入在Cacti中实现认证远程代码执行 摘要 Cacti ≤ 1.2.30 中存在一个操作系统命令注入漏洞，允许任何拥有设备和图形模板创建权限的认证用户在底层服务器上执行任意命令。该漏洞的存在是因为用户可控的主机元数据字段（具体是设备备注字段）通过 Cacti 的变量替换引擎被直接插入到 RRDtool 命令行参数中，而没有任何清洗或转义。攻击者可以在备注字段中注入 shell 元字符，构造一个引用 |hostnotes| 变量的图形模板，并触发图形渲染，从而以 Web 服务器用户的身份实现完全远程代码执行。 使用方法： python3...

CVE-2026-25089

🚨 CVE-2026-25089 - FortiSandbox 关键操作系统命令注入漏洞 📖 概述 CVE-2026-25089 是影响多个 Fortinet FortiSandbox 部署的一个关键 操作系统命令注入（CWE-78） 漏洞。 未经身份验证的远程攻击者可通过发送特制 HTTP 请求利用此缺陷，从而在底层操作系统上执行任意命令。 ⚠️ 成功利用可能导致设备完全沦陷及远程代码执行（RCE）。 🎯 漏洞详情 字段| 值 ---|--- CVE| CVE-2026-25089 严重性| Critical CWE| CWE-78 攻击类型| 操作系统命令注入 认证| 不需要 用户交互...

CVE-2026-5426

CVE-2026-5426 ⚡ 简单使用 请仅在安全且获得授权的环境中使用本项目，例如： 本地虚拟机 Docker 容器 隔离的实验环境 已授权的渗透测试环境 示例设置： git clone cd 示例用法： 测试单个目标是否存在漏洞 python cve-2026-5426.py -t https://example.com 从文件扫描多个目标 python cve-2026-5426.py -t targets.txt 在存在漏洞的目标上执行命令 python cve-2026-5426.py -t https://example.com -c "whoami" 执行复杂命令...

CVE-2019-15107_detection

CVE-2019-15107detection 该脚本用于判断服务器是否运行存在漏洞的 Webmin 版本。 Webmin =1.920 命令注入 - CVE-2019-15107...

Important: Red Hat Security Advisory: vim security update

An update for vim is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

A flaw was found in Vim, an open-source command-line text editor. An attacker could craft a malicious tags file that, when processed by Vim's C omni-completion feature, leads to insufficient escaping of input. This vulnerability allows for the execution of arbitrary Ex commands and, subsequently,...

RLSA-2026:75769 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

vim security update

An update is available for vim. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Vim Vi IMproved is an updated and improved version of the vi editor. Security...

packetfence-CVE-2024-39024

关于 安全研究员：ly1g3, ly1g3attuta.io GPG 指纹：https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 概述：远程代码执行 - 从低权限认证用户到管理员 RCE CVE：CVE-2024-3924 时间线： 发现 - ly1g3 报告 - ly1g3 修复 - packetfence 参考：https://www.packetfence.com/news/2024/packetfence-14-0-released/ Packetfence...

CVE-2026-82592

D-Link Router DIR-825M - Desbordamiento de Búfer en /boafrm/formDiskFormat Detalles de la Vulnerabilidad Información Detallada Campo| Valor ---|--- Vendedor| D-Link Producto| D-Link DIR-825M y otros modelos que comparten la misma base de código de firmware Versión Afectada| Firmware v1.1.8 Tipo d...

BIT-VIRTUALENV-2026-102937 virtualenv: Command injection via --prompt in activate.bat (batch activator)

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

Axis1.4-CVE-2019-0227

Axis1.4 CVE-2019-0227 远程命令执行漏洞利用工具 📖 漏洞描述 Apache Axis1.4 中存在一个远程命令执行漏洞（CVE-2019-0227）。当 enableRemoteAdmin 属性设置为 true 时，攻击者可以通过 AdminService 接口部署恶意服务，从而在目标服务器上执行任意系统命令。 影响版本 ：Apache Axis ≤ 1.4 触发条件 ：enableRemoteAdmin 设置为 true 🎯 两种利用方式 方式| 脚本| 原理| 是否写文件| 隐蔽性 ---|---|---|---|--- 方式一：JSP Webshell|...