CVE-2026-101947

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

EUVD-2026-96030

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

CVE-2026-101947

The ExifTool for photo and video 5.0.1-gms by CellHubs is vulnerable to a Local OS command injection (CWE-78). The flaw exists in the CSV-export path because the application constructs shell command strings from file paths and invokes /system/bin/sh -c without properly escaping embedded single qu...

CVE-2026-101947 ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

CVE-2026-101947 ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

PT-2026-109470

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

CVE-2026-55897

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-55897 luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-55897 luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

EUVD-2026-84101

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-55897

luci-app-advanced-reboot , a LuCI web UI application for OpenWrt, contained a read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json that granted rpcd file.exec permission for the general shell interpreter /bin/sh . Prior to version 1.1.2-6 , an ...

Apache HTTP Server 2.4.49-2.4.50 - CGI Path Traversal RCE (CVE-2021-42013)

Exploits CVE-2021-42013 using double-encoded .%%32%65/ traversal to reach bin/sh under a mapped Alias/ScriptAlias and run OS commands. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49-2.4.50 double-encoded CGI RCE CVE-2021-42013 — opens...

Apache HTTP Server 2.4.49 - CGI Path Traversal RCE (CVE-2021-41773)

Exploits CVE-2021-41773 by POSTing shell commands to an encoded path ending in bin/sh under a mapped Alias/ScriptAlias cgi-bin/icons. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49 CGI path-traversal RCE CVE-2021-41773 — opens execute...

Apache HTTP Server 2.4.49-2.4.50 - Path Traversal / RCE Detection (CVE-2021-42013)

Detects CVE-2021-42013 incomplete fix for CVE-2021-41773 using double-encoded .%%32%65/ traversal to read /etc/passwd or execute via CGI bin/sh. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49-2.4.50 double-encoded path traversal / CGI RCE CVE-2021-42013.""" import re from...

Malicious code in sextant-cli-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30 sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top a...

CVE-2026-45564

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /config/versions////save interpolates the URL-path configver parameter directly into a config-version path that ends up at os.systemf"dos2unix -q cfg". configver is not run...

CVE-2026-45564: Improper Neutralization of Special Elements used in an OS Command

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /config/versions/ / / /save interpolates the URL-path configver parameter directly into a config-version path that ends up at os.systemf"dos2unix -q cfg". configver is not ru...

PT-2026-44932

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.3 Description Dokploy constructs shell commands using JavaScript template literals and executes them via the child process.exec function, which runs through /bin/sh -c. User-supplied data, specifically branch...

Malicious code in randomlogs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c085eee0876092131c3f909facc237674fcfb1e02bafbafcb34230c87b3a3819 The package's main module index.js lines 6-10 exports a function mal that opens a TCP socket to 223.229.156.10:5513 and pipes a spawned shell /bin/sh...

Command Injection

Arcane is vulnerable to Command Injection. The vulnerability is due to lifecycle label values such as com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update being passed directly to /bin/sh -c without sanitization, allowing authenticated users to inject...