PoC Archive PoC Archive

tag

Ssh

  • CVE-2025-59718 network CRITICAL 9.8 KEV EPSS 63%

    FortiOS/FortiProxy/FortiSwitchManager/FortiWeb FortiCloud SSO Authentication Bypass Detection Tool (CVE-2025-59718)

    CVE-2025-59718 is an improper verification of a cryptographic signature in Fortinet's FortiCloud SSO admin-login flow across FortiOS, FortiProxy, FortiSwitchManager, and FortiWeb, allowing authentication bypass when admin-forticloud-sso-login is enabled on a…

    Patched 2026-07-06
  • CVE-2026-1459 network HIGH

    Zyxel VMG3625-T50B Authenticated Command Injection to Root SSH Access (CVE-2026-1459)

    The router's web management interface exposes a TR369Certificates CGI endpoint whose name parameter, used during a certificate "download" action, is passed unsanitized into a shell command executed as root. An authenticated administrator (or attacker with…

    Unverified 2026-07-05
  • CVE-2026-8697 network CRITICAL 9.3

    TP-Link Archer C64 Web UI Rate-Limit Bypass via Residual Debug SSH Service (CVE-2026-8697)

    The TP-Link Archer C64 exposes a residual debug SSH service (port 22) that does not grant a shell — it simply closes the connection once a password is entered — but validates the password against the same credential used by the router's web admin interface,…

    Unverified 2026-07-05
  • CVE-2026-22804 web HIGH

    Termix Stored XSS via Malicious SVG Upload -> LFI / Session Hijack (CVE-2026-22804 / GHSA-m3cv-5hgp-hv35)

    Termix's built-in File Manager renders SVG files opened from a connected host using dangerouslySetInnerHTML, without stripping active content such as <foreignObject>/<img onerror=...>. An attacker who can place a crafted SVG on a filesystem reachable via…

    Patched 2026-07-05
  • CVE-2026-4631 web CRITICAL 9.8 EPSS 15%

    Cockpit Unauthenticated Remote Code Execution via SSH Argument Injection (CVE-2026-4631)

    Cockpit's remote-login feature passes attacker-controlled hostnames (from the URL path) and usernames (from the Authorization: Basic header) directly to the OpenSSH ssh client without validation or a -- end-of-options separator. Because both values are used…

    Patched 2026-07-05
  • CVE-2026-55200 network CRITICAL

    libssh2 Unchecked SSH packet_length Integer Wrap to RCE (CVE-2026-55200)

    CVE-2026-55200 is an unchecked packetlength condition in libssh2's ssh2transportread() transport-parsing path. The vulnerable code accepts an attacker-controlled decrypted SSH packetlength field and only rejects values less than 1, then computes an allocation…

    Patched 2026-07-03
  • None assigned as of 2026-07-03 network CRITICAL

    libssh2 Publickey Subsystem List Parser Heap Corruption to Code Execution

    libssh2publickeylistfetch() parses a stream of publickey-subsystem response packets and grows an array of libssh2publickeylist entries as responses arrive, but the parser has two distinct memory-safety defects depending on target architecture. On 32-bit…

    Unverified 2026-07-03
  • CVE-2026-55200 network CRITICAL 9.8

    libssh2 SSH Packet Length OOB Heap Write / Unauthenticated RCE (CVE-2026-55200)

    CVE-2026-55200 is a critical heap out-of-bounds write in libssh2's SSH transport layer (ssh2transportread() in src/transport.c). The function validates that packetlength is greater than zero but performs no upper-bound check, allowing an attacker-controlled…

    Patched 2026-06-30
  • CVE-2025-32433 network CRITICAL 10 KEV EPSS 99%

    Erlang/OTP SSH Pre-Auth RCE - CVE-2025-32433

    CVE-2025-32433 is a critical pre-authentication remote code execution vulnerability in the Erlang/OTP SSH server with a CVSS score of 10.0. An attacker with network access to any service built on Erlang/OTP's SSH daemon can execute arbitrary OS commands…

    Patched 2026-05-17