Cwe-78

EXPLOIT DEV · Mar 2026 · 8 min read

Remote Code Execution in docker-wkhtmltopdf-aas: Command Injection via Unsanitized Options

How I found a critical command injection vulnerability in docker-wkhtmltopdf-aas, a Dockerized HTML-to-PDF web service, and achieved remote code execution as root through …

EXPLOIT DEV · Feb 2026 · 6 min read

Finding an RCE in iOS-remote: OS Command Injection via Flask

How I found an OS command injection vulnerability in iOS-remote, a Flask-based iOS device management tool, and achieved remote code execution through an unsanitized subprocess …