Argument-Injection — PoC Archivehttps://poc.intelseclab.com/tags/argument-injection/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000Cisco IMC Argument Injection to Root RCE (CVE-2026-20200)https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-20200-cisco-imc-argument-injection-rce/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-20200-cisco-imc-argument-injection-rce/Critical severity (CVSS 9.9) — network · CVE-2026-20200 / NSIDE-SA-2026-003. Status: Patched. Affects: Cisco Integrated Management Controller (CIMC). Tags: cisco, imc, cimc, argument-injection, rce, redfish, curl, reverse-shell, arm, file-read, file-write, CVE-2026-20200.networkCriticalciscoimccimcargument-injectionrceredfishcurlreverse-shellarmfile-readfile-writeCVE-2026-20200Weblate Arbitrary File Read via ssh-keyscan Host Argument Injection — CVE-2026-24126https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24126-weblate-ssh-keyscan-file-read/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24126-weblate-ssh-keyscan-file-read/High severity (CVSS 6.5) — web · CVE-2026-24126. Status: PoC. Affects: Weblate (self-hosted translation platform). Tags: weblate, argument-injection, command-injection, ssh-keyscan, arbitrary-file-read, authenticated, python, cwe-88.webHighweblateargument-injectioncommand-injectionssh-keyscanarbitrary-file-readauthenticatedpythoncwe-88Prefect GitRepository Git Argument Injection RCE via `commit_sha` — CVE-2026-5366https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5366-prefect-git-argument-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5366-prefect-git-argument-injection/High severity — web · CVE-2026-5366 (Huntr bounty e2e88a0f-a8f6-49c9-94c5-e98dc385f07a). Status: PoC. Affects: Prefect (workflow orchestration platform), GitRepository storage class. Tags: prefect, git, argument-injection, rce, upload-pack, workflow-orchestration, supply-chain, python.webHighprefectgitargument-injectionrceupload-packworkflow-orchestrationsupply-chainpythonPardus Software Center Local Privilege Escalation via APT Option Injection (CVE-2026-14459 / CVE-2026-14460)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-14459-pardus-software-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-14459-pardus-software-lpe/High severity (CVSS 8.8) — binary · CVE-2026-14459 (also covers CVE-2026-14460). Status: Weaponized. Affects: pardus-software (Pardus Software Center). Tags: linux, pardus, privilege-escalation, polkit, pkexec, apt-injection, argument-injection, local-dos.binaryHighlinuxpardusprivilege-escalationpolkitpkexecapt-injectionargument-injectionlocal-dosFireshare Unauthenticated Arbitrary File Write/Overwrite — CVE-2026-54337https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54337-fireshare-file-overwrite/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54337-fireshare-file-overwrite/Info severity — web · CVE-2026-54337 (see [GHSA-hmh2-6g84-q8jx](https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-hmh2-6g84-q8jx)). Status: PoC. Affects: Fireshare (self-hosted video sharing app), <= 1.16.3. Tags: fireshare, unauthenticated, arbitrary-file-write, argument-injection, ffmpeg, file-upload, cwe-73, docker.webInfofireshareunauthenticatedarbitrary-file-writeargument-injectionffmpegfile-uploadcwe-73dockerexiftool-vendored.js Argument Injection via Newline-Delimited Tag Names (CVE-2026-43893)https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-43893-exiftool-vendored-arg-injection-file-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-43893-exiftool-vendored-arg-injection-file-write/High severity (CVSS 8.2) — misc · CVE-2026-43893 / GHSA-cw26-7653-2rp5. Status: PoC. Affects: exiftool-vendored (npm package, Node.js wrapper around Phil Harvey's ExifTool). Tags: exiftool, exiftool-vendored, argument-injection, arbitrary-file-write, arbitrary-file-read, nodejs, cli-wrapper, newline-injection.miscHighexiftoolexiftool-vendoredargument-injectionarbitrary-file-writearbitrary-file-readnodejscli-wrappernewline-injectionCockpit Unauthenticated Remote Code Execution via SSH Argument Injection (CVE-2026-4631)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4631-cockpit-ssh-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4631-cockpit-ssh-rce/Critical severity (CVSS 9.8) — web · CVE-2026-4631 (GHSA-m4gv-x78h-3427). Status: PoC. Affects: Cockpit (Linux web-based server admin console). Tags: cockpit, ssh, command-injection, argument-injection, cwe-78, unauthenticated-rce, proxycommand.webCriticalcockpitsshcommand-injectionargument-injectioncwe-78unauthenticated-rceproxycommand