Command-Injection — PoC Archivehttps://poc.intelseclab.com/tags/command-injection/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000UniFi OS -- Unauthenticated Command Injection RCE (CVE-2026-34910)https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-34910-unifi-os-unauth-rce/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-34910-unifi-os-unauth-rce/Critical severity (CVSS 10) — network · CVE-2026-34910, CVE-2026-34909, CVE-2026-34908. Status: Patched. Affects: Ubiquiti UniFi OS Server. Tags: ubiquiti, unifi, unifi-os, auth-bypass, path-traversal, command-injection, rce, unauth, kev, mirai, nginx, CVE-2026-34910.networkCriticalubiquitiunifiunifi-osauth-bypasspath-traversalcommand-injectionrceunauthkevmirainginxCVE-2026-34910CyberPanel Pre-Auth Remote Code Execution via getresetstatus Command Injection (CVE-2024-51378)https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2024-51378-cyberpanel-preauth-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2024-51378-cyberpanel-preauth-rce/Critical severity (CVSS 10) — web · CVE-2024-51378. Status: Patched (commit 1c0c6cb; CyberPanel 2.3.8 and later). Affects: CyberPanel (aka Cyber Panel), by CyberPersons — Django-based hosting control panel. Tags: cyberpanel, rce, command-injection, preauth, unauthenticated, options-method, secmiddleware-bypass, statusfile, kev, ransomware, psaux, python, httpx, cve-2024-51378.webCriticalcyberpanelrcecommand-injectionpreauthunauthenticatedoptions-methodsecmiddleware-bypassstatusfilekevransomwarepsauxpythonhttpxcve-2024-51378D-Link DIR-820L `get_set.ccp` LAN Configuration OS Command Injection (CVE-2022-26258)https://poc.intelseclab.com/pocs/network/2026-07-11_cve-2022-26258-dlink-dir820l-command-injection/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-11_cve-2022-26258-dlink-dir820l-command-injection/Critical severity (CVSS 9.8) — network · CVE-2022-26258. Status: Weaponized (public PoC available; listed in CISA KEV). Affects: D-Link DIR-820L wireless router, all hardware revisions. Tags: d-link, dir-820l, router, command-injection, cwe-78, unauthenticated, remote, iot, eol-device, kev.networkCriticald-linkdir-820lroutercommand-injectioncwe-78unauthenticatedremoteioteol-devicekevtj-actions/branch-names GitHub Actions Command Injection (CVE-2025-54416)https://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-54416-tj-actions-branch-names-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-54416-tj-actions-branch-names-command-injection/Critical severity (CVSS 9.1) — cloud · CVE-2025-54416. Status: PoC. Affects: tj-actions/branch-names GitHub Action. Tags: github-actions, ci-cd, command-injection, supply-chain, tj-actions, branch-names, secrets-exfiltration, shell-injection.cloudCriticalgithub-actionsci-cdcommand-injectionsupply-chaintj-actionsbranch-namessecrets-exfiltrationshell-injectionReact Native Community CLI Metro Dev Server `/open-url` OS Command Injection (CVE-2025-11953)https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-11953-react-native-metro-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-11953-react-native-metro-command-injection/Critical severity (CVSS 9.8) — network · CVE-2025-11953. Status: Weaponized. Affects: @react-native-community/cli / @react-native-community/cli-server-api (Metro Development Server, openURLMiddleware). Tags: react-native, metro, dev-server, cli-server-api, open-url, command-injection, cwe-78, unauthenticated, node.js, python, windows, cross-platform.networkCriticalreact-nativemetrodev-servercli-server-apiopen-urlcommand-injectioncwe-78unauthenticatednode.jspythonwindowscross-platformpgAdmin 4 Restore Feature Regex-Bypass Command Injection RCE (CVE-2025-13780)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13780-pgadmin4-regex-bypass-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13780-pgadmin4-regex-bypass-rce/Critical severity (CVSS 9.1) — web · CVE-2025-13780. Status: Weaponized. Affects: pgAdmin 4. Tags: pgadmin4, postgresql, regex-bypass, command-injection, psql-meta-command, utf8-bom, crlf-injection, rce, python, cwe-77, cwe-88.webCriticalpgadmin4postgresqlregex-bypasscommand-injectionpsql-meta-commandutf8-bomcrlf-injectionrcepythoncwe-77cwe-88Mongoose `populate()` Match `$where` Bypass Command Injection (CVE-2025-23061)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-23061-mongoose-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-23061-mongoose-command-injection/Critical severity (CVSS 9) — web · CVE-2025-23061. Status: Weaponized. Affects: Mongoose (Node.js MongoDB ODM). Tags: mongoose, nodejs, nosql-injection, mongodb, populate, where-operator, command-injection, rce, cwe-943, cwe-94, express.webCriticalmongoosenodejsnosql-injectionmongodbpopulatewhere-operatorcommand-injectionrcecwe-943cwe-94expressHPE OneView `id-pools/executeCommand` OS Command Injection (CVE-2025-37164)https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-37164-hpe-oneview-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-37164-hpe-oneview-command-injection/Critical severity (CVSS 10) — network · CVE-2025-37164. Status: PoC. Affects: HPE OneView (infrastructure management appliance) REST API. Tags: hpe-oneview, command-injection, os-command-execution, rce, rest-api, python, cwe-78.networkCriticalhpe-oneviewcommand-injectionos-command-executionrcerest-apipythoncwe-78Hoverfly Middleware Command Injection to RCE (CVE-2025-54123)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54123-hoverfly-middleware-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54123-hoverfly-middleware-rce/Critical severity (CVSS 9.8) — web · CVE-2025-54123. Status: Weaponized. Affects: SpectoLabs Hoverfly (HTTP/API service virtualization tool) — admin API, <= v1.11.3. Tags: hoverfly, command-injection, middleware, api, token-auth, rce, cwe-78, python.webCriticalhoverflycommand-injectionmiddlewareapitoken-authrcecwe-78pythonD-Link AX1500 SetDeviceSettings `DeviceName` OS Command Injection (CVE-2025-60854)https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-60854-dlink-ax1500-devicename-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-60854-dlink-ax1500-devicename-command-injection/Critical severity (CVSS 9.8) — network · CVE-2025-60854. Status: Weaponized. Affects: D-Link AX1500 router firmware (HNAP/DHMAPI web management SOAP interface). Tags: d-link, ax1500, router, command-injection, os-command-injection, hnap, soap, telnetd, cwe-78, iot.networkCriticald-linkax1500routercommand-injectionos-command-injectionhnapsoaptelnetdcwe-78iotZyxel VMG3625-T50B Authenticated Command Injection to Root SSH Access (CVE-2026-1459)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-1459-zyxel-router-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-1459-zyxel-router-command-injection/High severity — network · CVE-2026-1459. Status: PoC. Affects: Zyxel VMG3625-T50B (and similar) router firmware. Tags: zyxel, router, firmware, command-injection, cgi-bin, ssh, authenticated, iot.networkHighzyxelrouterfirmwarecommand-injectioncgi-binsshauthenticatediotWeblate Arbitrary File Read via ssh-keyscan Host Argument Injection — CVE-2026-24126https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24126-weblate-ssh-keyscan-file-read/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24126-weblate-ssh-keyscan-file-read/High severity (CVSS 6.5) — web · CVE-2026-24126. Status: PoC. Affects: Weblate (self-hosted translation platform). Tags: weblate, argument-injection, command-injection, ssh-keyscan, arbitrary-file-read, authenticated, python, cwe-88.webHighweblateargument-injectioncommand-injectionssh-keyscanarbitrary-file-readauthenticatedpythoncwe-88Vim Modeline `path` Option Backtick-Expansion Command Injection (CVE-2026-44656)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-44656-vim-modeline-path-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-44656-vim-modeline-path-command-injection/High severity — binary · CVE-2026-44656. Status: PoC. Affects: Vim. Tags: vim, modeline, command-injection, backtick-expansion, path-option, local-code-execution.binaryHighvimmodelinecommand-injectionbacktick-expansionpath-optionlocal-code-executionTP-Link Tapo C260 Unauthenticated-to-Root RCE Chain — CVE-2026-0651https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-0651-tapo-c260-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-0651-tapo-c260-rce/Critical severity — network · CVE-2026-0651 (chained with CVE-2026-0652, CVE-2026-0653). Status: Weaponized. Affects: TP-Link Tapo C260 IP camera (pre-patch firmware, shared /bin/main omnibus binary across models). Tags: iot, ip-camera, tp-link, tapo, path-traversal, command-injection, privilege-escalation, exploit-chain.networkCriticaliotip-cameratp-linktapopath-traversalcommand-injectionprivilege-escalationexploit-chainTP-Link DHCP Option 66 Unauthenticated RCE — CVE-2026-11834https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11834-tplink-dhcp-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11834-tplink-dhcp-rce/Critical severity — network · CVE-2026-11834. Status: Weaponized. Affects: TP-Link router firmware (libcmm.so DHCP client), tested on Archer C20 V6. Tags: tp-link, router, dhcp, command-injection, cwe-78, race-condition, rce, iot.networkCriticaltp-linkrouterdhcpcommand-injectioncwe-78race-conditionrceiotSupply Chain Command Injection in AWS CDK's NodejsFunction — CVE-2026-11417https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-11417-aws-cdk-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-11417-aws-cdk-rce/High severity (CVSS 3.1) — cloud · CVE-2026-11417. Status: PoC. Affects: aws-cdk-lib (npm package), NodejsFunction L2 construct. Tags: aws, cdk, supply-chain, command-injection, esbuild, nodejs, ci-cd, rce.cloudHighawscdksupply-chaincommand-injectionesbuildnodejsci-cdrceSpinnaker Clouddriver — Git Clone Shell Injection RCE (CVE-2026-32604)https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-32604-spinnaker-git-clone-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-32604-spinnaker-git-clone-rce/Critical severity (CVSS 10) — cloud · CVE-2026-32604 (CWE-78). Status: PoC. Affects: Spinnaker (Clouddriver service) — continuous delivery / multi-cloud orchestration platform. Tags: spinnaker, clouddriver, command-injection, rce, cd-pipeline, cloud-credentials, shell-injection, docker-lab.cloudCriticalspinnakerclouddrivercommand-injectionrcecd-pipelinecloud-credentialsshell-injectiondocker-labSherlock CI `pull_request_target` Command Injection → GitHub Actions Secret Exfiltration (CVE-2026-44590)https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-44590-sherlock-pull-request-target-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-44590-sherlock-pull-request-target-rce/Critical severity (CVSS 9.3) — cloud · CVE-2026-44590. Status: PoC. Affects: sherlock-project/sherlock (GitHub Actions workflow validate_modified_targets.yml). Tags: github-actions, pull_request_target, command-injection, ci-cd, supply-chain, token-exfiltration, sherlock.cloudCriticalgithub-actionspull_request_targetcommand-injectionci-cdsupply-chaintoken-exfiltrationsherlockSamba spoolss Print Job Command Injection RCE (CVE-2026-4480)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-4480-samba-spoolss-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-4480-samba-spoolss-rce/Critical severity — network · CVE-2026-4480. Status: PoC. Affects: Samba (spoolss / print spooler RPC service). Tags: samba, spoolss, smb, printer, rpc, command-injection, reverse-shell.networkCriticalsambaspoolsssmbprinterrpccommand-injectionreverse-shellRed Hat Cockpit `logsJournal.jsx` Shell Injection RCE (CVE-2026-4802)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4802-cockpit-logsjournal-shell-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4802-cockpit-logsjournal-shell-injection/High severity — web · CVE-2026-4802. Status: PoC. Affects: Red Hat Cockpit — the web-based Linux system administration console (cockpit-project.org), specifically pkg/systemd/logsJournal.jsx. **Not** to be confused with the headless "Cockpit CMS".. Tags: cockpit, redhat, shell-injection, command-injection, rce, websocket, systemd, journalctl.webHighcockpitredhatshell-injectioncommand-injectionrcewebsocketsystemdjournalctlrclone RC API Unauthenticated Remote Code Execution (CVE-2026-41179)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41179-rclone-rc-api-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41179-rclone-rc-api-rce/Critical severity (CVSS 9.8) — web · CVE-2026-41179. Status: Weaponized. Affects: rclone (Remote Control / rcd HTTP API). Tags: rclone, rce, unauthenticated, webdav, rc-api, command-injection, docker-lab.webCriticalrclonerceunauthenticatedwebdavrc-apicommand-injectiondocker-labOS Command Injection in KubeAI via Model URL (CVE-2026-34940)https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-34940-kubeai-ollama-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-34940-kubeai-ollama-command-injection/High severity (CVSS 8.7) — cloud · CVE-2026-34940. Status: PoC. Affects: KubeAI (github.com/kubeai-project/kubeai). Tags: kubernetes, kubeai, command-injection, ollama, crd, kubectl, model-serving, cwe-78.cloudHighkuberneteskubeaicommand-injectionollamacrdkubectlmodel-servingcwe-78OpenXDMoD `user_interface.php` Report Title Command Injection (CVE-2026-45777)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-45777-openxdmod-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-45777-openxdmod-command-injection/Critical severity — web · CVE-2026-45777. Status: PoC. Affects: Open XDMoD (XD Metrics on Demand). Tags: command-injection, openxdmod, php, unauthenticated, rce, report-generation.webCriticalcommand-injectionopenxdmodphpunauthenticatedrcereport-generationOpenClaw Gateway WebSocket Authentication Bypass RCE — CVE-2026-28466https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-28466-openclaw-gateway-websocket-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-28466-openclaw-gateway-websocket-rce/Critical severity — network · CVE-2026-28466. Status: Weaponized. Affects: OpenClaw gateway. Tags: openclaw, websocket, rce, gateway, auth-bypass, node-invoke, command-injection.networkCriticalopenclawwebsocketrcegatewayauth-bypassnode-invokecommand-injectionOliveTin OS Command Injection via Shell Mode Arguments (CVE-2026-27626)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27626-olivetin-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27626-olivetin-command-injection/Critical severity (CVSS 9.9) — web · CVE-2026-27626 / GHSA-49gm-hh7w-wfvf. Status: PoC. Affects: OliveTin (self-hosted web UI for exposing predefined shell commands). Tags: command-injection, olivetin, rce, webhook, shell-mode, cwe-78, self-hosted.webCriticalcommand-injectionolivetinrcewebhookshell-modecwe-78self-hostedMR9600 Router Bluetooth/JNAP Management Interface RCE Injection (CVE-2026-6992)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-6992-mr9600-router-bluetooth-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-6992-mr9600-router-bluetooth-rce/High severity — network · CVE-2026-6992. Status: PoC. Affects: MR9600 router (Bluetooth-capable administrative interface). Tags: router, bluetooth, jnap, command-injection, iot, rce.networkHighrouterbluetoothjnapcommand-injectioniotrceMeiG Smart FORGE_SLT711 GoAhead Unauthenticated OS Command Injection (CVE-2026-36356)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-36356-meig-smart-router-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-36356-meig-smart-router-command-injection/Critical severity — network · CVE-2026-36356. Status: Weaponized. Affects: MeiG Smart FORGE_SLT711 4G LTE CPE (GoAhead web server). Tags: meig-smart, 4g-lte-cpe, router, command-injection, goahead, unauthenticated, root, cwe-78, cwe-306.networkCriticalmeig-smart4g-lte-cperoutercommand-injectiongoaheadunauthenticatedrootcwe-78cwe-306MCPJam Inspector Unauthenticated Command Injection RCE (CVE-2026-23744)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23744-mcpjam-inspector-htb-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23744-mcpjam-inspector-htb-rce/Critical severity — web · CVE-2026-23744. Status: PoC. Affects: MCPJam Inspector v1.4.2. Tags: mcpjam-inspector, mcp, command-injection, rce, curl, hack-the-box, reverse-shell, chained-privesc.webCriticalmcpjam-inspectormcpcommand-injectionrcecurlhack-the-boxreverse-shellchained-privescMCPJam Inspector / Arcane MCP Connect Command Injection RCE via Host-Header Vhost Routing (CVE-2026-23520)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23520-mcpjam-inspector-vhost-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23520-mcpjam-inspector-vhost-rce/Critical severity — web · CVE-2026-23520. Status: PoC. Affects: Arcane v1.13.0 (MCPJam Inspector component). Tags: mcp, mcpjam-inspector, arcane, command-injection, rce, host-header, vhost-routing, reverse-shell.webCriticalmcpmcpjam-inspectorarcanecommand-injectionrcehost-headervhost-routingreverse-shellIvanti EPMM Pre-Auth RCE via Bash Arithmetic Expansion (CVE-2026-1281 / CVE-2026-1340)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-1281-ivanti-epmm-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-1281-ivanti-epmm-rce/Critical severity — network · CVE-2026-1281, CVE-2026-1340. Status: PoC. Affects: Ivanti Endpoint Manager Mobile (EPMM), map-appstore-url CGI handler. Tags: ivanti, epmm, mobileiron, pre-auth-rce, bash, arithmetic-expansion, command-injection, docker-lab.networkCriticalivantiepmmmobileironpre-auth-rcebasharithmetic-expansioncommand-injectiondocker-labHAXcms Git.php OS Command Injection (CVE-2026-46394)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46394-haxcms-git-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46394-haxcms-git-command-injection/High severity (CVSS 7.2) — web · CVE-2026-46394. Status: PoC. Affects: HAXcms PHP backend (elmsln/HAXcms) — system/backend/php/lib/Git.php. Tags: haxcms, php, command-injection, cwe-78, git, proc_open, cms.webHighhaxcmsphpcommand-injectioncwe-78gitproc_opencmsGroup-Office TNEF Attachment Handler OS Command Injection (CVE-2026-25512)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25512-groupoffice-tnef-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25512-groupoffice-tnef-command-injection/Critical severity (CVSS 9.4) — web · CVE-2026-25512. Status: Weaponized. Affects: Group-Office groupware/webmail suite. Tags: command-injection, rce, groupware, email, tnef, cwe-78, authenticated, webmail.webCriticalcommand-injectionrcegroupwareemailtnefcwe-78authenticatedwebmailGotenberg 8.29.1 Unauthenticated ExifTool Metadata Key Injection RCE (CVE-2026-42589)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42589-gotenberg-exiftool-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42589-gotenberg-exiftool-rce/Critical severity (CVSS 9.8) — web · CVE-2026-42589. Status: PoC. Affects: Gotenberg (document/PDF conversion microservice). Tags: gotenberg, exiftool, command-injection, cwe-78, unauthenticated, rce, docker-lab, nuclei.webCriticalgotenbergexiftoolcommand-injectioncwe-78unauthenticatedrcedocker-labnucleiFortinet FortiSandbox "Start VNC" OS Command Injection (CVE-2026-25089)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-25089-fortisandbox-cmd-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-25089-fortisandbox-cmd-injection/Critical severity (CVSS 9.8) — network · CVE-2026-25089. Status: PoC. Affects: Fortinet FortiSandbox (Web UI "start VNC" feature). Tags: fortisandbox, fortinet, command-injection, cwe-78, unauthenticated, rce, appliance, network.networkCriticalfortisandboxfortinetcommand-injectioncwe-78unauthenticatedrceappliancenetworkExifTool Metadata Field Command Injection (macOS) — CVE-2026-3102https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3102-exiftool-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3102-exiftool-command-injection/High severity — binary · CVE-2026-3102. Status: PoC. Affects: ExifTool. Tags: exiftool, command-injection, macos, metadata, reverse-shell, tagsfromfile, perl.binaryHighexiftoolcommand-injectionmacosmetadatareverse-shelltagsfromfileperlCoolify Authenticated Remote Command Injection via Deployment Config (CVE-2026-34038)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34038-coolify-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34038-coolify-command-injection/Critical severity (CVSS 10) — web · CVE-2026-34038 (GHSA-qqrq-r9h4-x6wp). Status: PoC. Affects: Coolify (self-hosted PaaS/deployment platform). Tags: coolify, command-injection, cwe-78, rce, deployment, docker, api.webCriticalcoolifycommand-injectioncwe-78rcedeploymentdockerapiCockpit Unauthenticated Remote Code Execution via SSH Argument Injection (CVE-2026-4631)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4631-cockpit-ssh-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4631-cockpit-ssh-rce/Critical severity (CVSS 9.8) — web · CVE-2026-4631 (GHSA-m4gv-x78h-3427). Status: PoC. Affects: Cockpit (Linux web-based server admin console). Tags: cockpit, ssh, command-injection, argument-injection, cwe-78, unauthenticated-rce, proxycommand.webCriticalcockpitsshcommand-injectionargument-injectioncwe-78unauthenticated-rceproxycommandCentreon Multi-Vector RCE — Path Traversal, Command Injection & Blind SQLi (CVE-2026-2749)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2749-centreon-multi-vector-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2749-centreon-multi-vector-rce/Critical severity — web · CVE-2026-2749 (bundled with related CVE-2026-2750, CVE-2026-2751). Status: Weaponized. Affects: Centreon (open-source IT infrastructure monitoring platform). Tags: centreon, path-traversal, rce, command-injection, sql-injection, clapi, monitoring, php.webCriticalcentreonpath-traversalrcecommand-injectionsql-injectionclapimonitoringphpCacti Authenticated OS Command Injection via Host Notes Variable (CVE-2026-39949)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39949-cacti-host-variable-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39949-cacti-host-variable-command-injection/High severity — web · CVE-2026-39949. Status: PoC. Affects: Cacti network monitoring platform. Tags: cacti, command-injection, cwe-78, rrdtool, authenticated, rce, oob, network-monitoring.webHighcacticommand-injectioncwe-78rrdtoolauthenticatedrceoobnetwork-monitoringcurl SMTP EXPN Recipient CRLF Command Injectionhttps://poc.intelseclab.com/pocs/network/2026-07-03_curl-smtp-expn-crlf-injection/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_curl-smtp-expn-crlf-injection/Medium severity — network · None assigned as of 2026-07-03. Status: PoC. Affects: curl / libcurl (SMTP support). Tags: curl, smtp, crlf-injection, command-injection, expn, vrfy, protocol-injection, libcurl.networkMediumcurlsmtpcrlf-injectioncommand-injectionexpnvrfyprotocol-injectionlibcurlAuthenticated Command Injection in LiteLLM MCP Test Endpoints (CVE-2026-42271)https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-42271-litellm-mcp-command-injection/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-42271-litellm-mcp-command-injection/High severity (CVSS 8.7) — web · CVE-2026-42271. Status: PoC. Affects: BerriAI LiteLLM (proxy) — MCP preview/test endpoints. Tags: command-injection, LiteLLM, MCP, AI-application, ai-gateway, authenticated, api-key, subprocess.webHighcommand-injectionLiteLLMMCPAI-applicationai-gatewayauthenticatedapi-keysubprocessUbiquiti UniFi OS Unauthenticated RCE Chain (CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910)https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-34908-unifi-os-rce-chain/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-34908-unifi-os-rce-chain/Critical severity (CVSS 10) — network · CVE-2026-34908, CVE-2026-34909, CVE-2026-34910. Status: PoC. Affects: Ubiquiti UniFi OS Server. Tags: unauth-rce, nginx-bypass, path-traversal, command-injection, CISA-KEV, Mirai, Gaafgyt, chain, UniFi, Ubiquiti, network.networkCriticalunauth-rcenginx-bypasspath-traversalcommand-injectionCISA-KEVMiraiGaafgytchainUniFiUbiquitinetworkCisco Catalyst SD-WAN Manager Privilege Escalation (CVE-2026-20245)https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-20245-cisco-sdwan-priv-esc/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-20245-cisco-sdwan-priv-esc/High severity (CVSS 7.8) — network · CVE-2026-20245. Status: PoC. Affects: Cisco Catalyst SD-WAN Manager (vManage), SD-WAN Controller (vSmart), SD-WAN Validator (vBond). Tags: privilege-escalation, Cisco, SD-WAN, vManage, file-upload, command-injection, root, CISA-KEV, no-patch, Mandiant, nation-state.networkHighprivilege-escalationCiscoSD-WANvManagefile-uploadcommand-injectionrootCISA-KEVno-patchMandiantnation-stateNotepad++ <= 8.9.6 Multiple Vulnerabilities (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800)https://poc.intelseclab.com/pocs/binary/2026-05-28_notepad-plus-plus-8-9-6-multi-cve/Thu, 28 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-28_notepad-plus-plus-8-9-6-multi-cve/High severity (CVSS 5) — binary · CVE-2026-48770, CVE-2026-48778, CVE-2026-48800. Status: Patched. Affects: Notepad++. Tags: Notepad++, Windows, OOB-read, DoS, command-injection, config.xml, shortcuts.xml, local.binaryHighNotepad++WindowsOOB-readDoScommand-injectionconfig.xmlshortcuts.xmllocalPalo Alto PAN-OS GlobalProtect Unauthenticated RCE (CVE-2024-3400)https://poc.intelseclab.com/pocs/web/2026-05-17_pan-os-globalprotect-unauth-rce/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_pan-os-globalprotect-unauth-rce/Critical severity (CVSS 10) — web · CVE-2024-3400. Status: Weaponized. Affects: Palo Alto Networks PAN-OS GlobalProtect gateway. Tags: RCE, command-injection, path-traversal, PAN-OS, GlobalProtect, unauthenticated, zero-day.webCriticalRCEcommand-injectionpath-traversalPAN-OSGlobalProtectunauthenticatedzero-day