Cwe-78 — PoC Archivehttps://poc.intelseclab.com/tags/cwe-78/Latest proof-of-concept entries.Hugoen-usSat, 11 Jul 2026 00:00:00 +0000Nagios XI 5.5.6–5.7.5 Authenticated OS Command Injection — Windows WMI Config Wizard (CVE-2021-25296)https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-25296-nagios-xi-windowswmi-command-injection/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-25296-nagios-xi-windowswmi-command-injection/High severity (CVSS 8.8) — web · CVE-2021-25296. Status: Weaponized (public Metasploit module + nuclei templates, in CISA KEV). Affects: Nagios XI — Windows WMI monitoring configuration wizard. Tags: nagios-xi, os-command-injection, authenticated, config-wizard, windowswmi, cwe-78, kev, metasploit.webHighnagios-xios-command-injectionauthenticatedconfig-wizardwindowswmicwe-78kevmetasploitNagios XI 5.5.6–5.7.5 Authenticated OS Command Injection — Switch Config Wizard (CVE-2021-25297)https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-25297-nagios-xi-switch-command-injection/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-25297-nagios-xi-switch-command-injection/High severity (CVSS 8.8) — web · CVE-2021-25297. Status: Weaponized (public Metasploit module + nuclei templates, in CISA KEV). Affects: Nagios XI — Switch (SNMP) monitoring configuration wizard. Tags: nagios-xi, os-command-injection, authenticated, config-wizard, switch, cwe-78, kev, metasploit.webHighnagios-xios-command-injectionauthenticatedconfig-wizardswitchcwe-78kevmetasploitNagios XI 5.5.6–5.7.5 Authenticated OS Command Injection — Cloud-VM Config Wizard (CVE-2021-25298)https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-25298-nagios-xi-cloudvm-command-injection/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2021-25298-nagios-xi-cloudvm-command-injection/High severity (CVSS 8.8) — web · CVE-2021-25298. Status: Weaponized (public Metasploit module + nuclei templates, in CISA KEV). Affects: Nagios XI — Cloud/VM monitoring configuration wizard (DigitalOcean provider sub-option). Tags: nagios-xi, os-command-injection, authenticated, config-wizard, cloud-vm, cwe-78, kev, metasploit.webHighnagios-xios-command-injectionauthenticatedconfig-wizardcloud-vmcwe-78kevmetasploitD-Link DIR-820L `get_set.ccp` LAN Configuration OS Command Injection (CVE-2022-26258)https://poc.intelseclab.com/pocs/network/2026-07-11_cve-2022-26258-dlink-dir820l-command-injection/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-11_cve-2022-26258-dlink-dir820l-command-injection/Critical severity (CVSS 9.8) — network · CVE-2022-26258. Status: Weaponized (public PoC available; listed in CISA KEV). Affects: D-Link DIR-820L wireless router, all hardware revisions. Tags: d-link, dir-820l, router, command-injection, cwe-78, unauthenticated, remote, iot, eol-device, kev.networkCriticald-linkdir-820lroutercommand-injectioncwe-78unauthenticatedremoteioteol-devicekevReact Native Community CLI Metro Dev Server `/open-url` OS Command Injection (CVE-2025-11953)https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-11953-react-native-metro-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-11953-react-native-metro-command-injection/Critical severity (CVSS 9.8) — network · CVE-2025-11953. Status: Weaponized. Affects: @react-native-community/cli / @react-native-community/cli-server-api (Metro Development Server, openURLMiddleware). Tags: react-native, metro, dev-server, cli-server-api, open-url, command-injection, cwe-78, unauthenticated, node.js, python, windows, cross-platform.networkCriticalreact-nativemetrodev-servercli-server-apiopen-urlcommand-injectioncwe-78unauthenticatednode.jspythonwindowscross-platformHPE OneView `id-pools/executeCommand` OS Command Injection (CVE-2025-37164)https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-37164-hpe-oneview-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-37164-hpe-oneview-command-injection/Critical severity (CVSS 10) — network · CVE-2025-37164. Status: PoC. Affects: HPE OneView (infrastructure management appliance) REST API. Tags: hpe-oneview, command-injection, os-command-execution, rce, rest-api, python, cwe-78.networkCriticalhpe-oneviewcommand-injectionos-command-executionrcerest-apipythoncwe-78Hoverfly Middleware Command Injection to RCE (CVE-2025-54123)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54123-hoverfly-middleware-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54123-hoverfly-middleware-rce/Critical severity (CVSS 9.8) — web · CVE-2025-54123. Status: Weaponized. Affects: SpectoLabs Hoverfly (HTTP/API service virtualization tool) — admin API, <= v1.11.3. Tags: hoverfly, command-injection, middleware, api, token-auth, rce, cwe-78, python.webCriticalhoverflycommand-injectionmiddlewareapitoken-authrcecwe-78pythonD-Link AX1500 SetDeviceSettings `DeviceName` OS Command Injection (CVE-2025-60854)https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-60854-dlink-ax1500-devicename-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-60854-dlink-ax1500-devicename-command-injection/Critical severity (CVSS 9.8) — network · CVE-2025-60854. Status: Weaponized. Affects: D-Link AX1500 router firmware (HNAP/DHMAPI web management SOAP interface). Tags: d-link, ax1500, router, command-injection, os-command-injection, hnap, soap, telnetd, cwe-78, iot.networkCriticald-linkax1500routercommand-injectionos-command-injectionhnapsoaptelnetdcwe-78iotTP-Link DHCP Option 66 Unauthenticated RCE — CVE-2026-11834https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11834-tplink-dhcp-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-11834-tplink-dhcp-rce/Critical severity — network · CVE-2026-11834. Status: Weaponized. Affects: TP-Link router firmware (libcmm.so DHCP client), tested on Archer C20 V6. Tags: tp-link, router, dhcp, command-injection, cwe-78, race-condition, rce, iot.networkCriticaltp-linkrouterdhcpcommand-injectioncwe-78race-conditionrceiotOS Command Injection in KubeAI via Model URL (CVE-2026-34940)https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-34940-kubeai-ollama-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-34940-kubeai-ollama-command-injection/High severity (CVSS 8.7) — cloud · CVE-2026-34940. Status: PoC. Affects: KubeAI (github.com/kubeai-project/kubeai). Tags: kubernetes, kubeai, command-injection, ollama, crd, kubectl, model-serving, cwe-78.cloudHighkuberneteskubeaicommand-injectionollamacrdkubectlmodel-servingcwe-78OliveTin OS Command Injection via Shell Mode Arguments (CVE-2026-27626)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27626-olivetin-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27626-olivetin-command-injection/Critical severity (CVSS 9.9) — web · CVE-2026-27626 / GHSA-49gm-hh7w-wfvf. Status: PoC. Affects: OliveTin (self-hosted web UI for exposing predefined shell commands). Tags: command-injection, olivetin, rce, webhook, shell-mode, cwe-78, self-hosted.webCriticalcommand-injectionolivetinrcewebhookshell-modecwe-78self-hostedMeiG Smart FORGE_SLT711 GoAhead Unauthenticated OS Command Injection (CVE-2026-36356)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-36356-meig-smart-router-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-36356-meig-smart-router-command-injection/Critical severity — network · CVE-2026-36356. Status: Weaponized. Affects: MeiG Smart FORGE_SLT711 4G LTE CPE (GoAhead web server). Tags: meig-smart, 4g-lte-cpe, router, command-injection, goahead, unauthenticated, root, cwe-78, cwe-306.networkCriticalmeig-smart4g-lte-cperoutercommand-injectiongoaheadunauthenticatedrootcwe-78cwe-306HAXcms Git.php OS Command Injection (CVE-2026-46394)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46394-haxcms-git-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46394-haxcms-git-command-injection/High severity (CVSS 7.2) — web · CVE-2026-46394. Status: PoC. Affects: HAXcms PHP backend (elmsln/HAXcms) — system/backend/php/lib/Git.php. Tags: haxcms, php, command-injection, cwe-78, git, proc_open, cms.webHighhaxcmsphpcommand-injectioncwe-78gitproc_opencmsGroup-Office TNEF Attachment Handler OS Command Injection (CVE-2026-25512)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25512-groupoffice-tnef-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25512-groupoffice-tnef-command-injection/Critical severity (CVSS 9.4) — web · CVE-2026-25512. Status: Weaponized. Affects: Group-Office groupware/webmail suite. Tags: command-injection, rce, groupware, email, tnef, cwe-78, authenticated, webmail.webCriticalcommand-injectionrcegroupwareemailtnefcwe-78authenticatedwebmailGotenberg 8.29.1 Unauthenticated ExifTool Metadata Key Injection RCE (CVE-2026-42589)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42589-gotenberg-exiftool-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42589-gotenberg-exiftool-rce/Critical severity (CVSS 9.8) — web · CVE-2026-42589. Status: PoC. Affects: Gotenberg (document/PDF conversion microservice). Tags: gotenberg, exiftool, command-injection, cwe-78, unauthenticated, rce, docker-lab, nuclei.webCriticalgotenbergexiftoolcommand-injectioncwe-78unauthenticatedrcedocker-labnucleiFortiSandbox 4.4.0-4.4.8 — OS Command Injection via tracer-behavior Endpoint (CVE-2026-39808)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-39808-fortisandbox-os-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-39808-fortisandbox-os-command-injection/Critical severity (CVSS 9.8) — network · CVE-2026-39808. Status: Weaponized — real, working exploit verified from two independent sources. Affects: Fortinet FortiSandbox. Tags: fortinet, fortisandbox, os-command-injection, unauthenticated, root-rce, cwe-78, actively-exploited, kev.networkCriticalfortinetfortisandboxos-command-injectionunauthenticatedroot-rcecwe-78actively-exploitedkevFortinet FortiSandbox "Start VNC" OS Command Injection (CVE-2026-25089)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-25089-fortisandbox-cmd-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-25089-fortisandbox-cmd-injection/Critical severity (CVSS 9.8) — network · CVE-2026-25089. Status: PoC. Affects: Fortinet FortiSandbox (Web UI "start VNC" feature). Tags: fortisandbox, fortinet, command-injection, cwe-78, unauthenticated, rce, appliance, network.networkCriticalfortisandboxfortinetcommand-injectioncwe-78unauthenticatedrceappliancenetworkCoolify Authenticated Remote Command Injection via Deployment Config (CVE-2026-34038)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34038-coolify-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34038-coolify-command-injection/Critical severity (CVSS 10) — web · CVE-2026-34038 (GHSA-qqrq-r9h4-x6wp). Status: PoC. Affects: Coolify (self-hosted PaaS/deployment platform). Tags: coolify, command-injection, cwe-78, rce, deployment, docker, api.webCriticalcoolifycommand-injectioncwe-78rcedeploymentdockerapiCockpit Unauthenticated Remote Code Execution via SSH Argument Injection (CVE-2026-4631)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4631-cockpit-ssh-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4631-cockpit-ssh-rce/Critical severity (CVSS 9.8) — web · CVE-2026-4631 (GHSA-m4gv-x78h-3427). Status: PoC. Affects: Cockpit (Linux web-based server admin console). Tags: cockpit, ssh, command-injection, argument-injection, cwe-78, unauthenticated-rce, proxycommand.webCriticalcockpitsshcommand-injectionargument-injectioncwe-78unauthenticated-rceproxycommandCacti Authenticated OS Command Injection via Host Notes Variable (CVE-2026-39949)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39949-cacti-host-variable-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39949-cacti-host-variable-command-injection/High severity — web · CVE-2026-39949. Status: PoC. Affects: Cacti network monitoring platform. Tags: cacti, command-injection, cwe-78, rrdtool, authenticated, rce, oob, network-monitoring.webHighcacticommand-injectioncwe-78rrdtoolauthenticatedrceoobnetwork-monitoring