42788 matches found
SUSE CVE-2026-4786
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open" API could have commands injected into the underlying shell. See CVE-2026-4519 for details...
Active Debug Code
Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Active Debug Code via the git.json.php script, which executes a shell command and returns sensitive information as JSON to any unauthenticated user. An attacker ca...
CVE-2026-39620
Cross-Site Request Forgery CSRF vulnerability in priyanshumittal Appointment appointment allows Upload a Web Shell to a Web Server.This issue affects Appointment: from n/a through = 3.5.5...
CVE-2026-32892
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move function in fileManage.lib.php passes user-controlled path values directly into exec shell commands without using...
EUVD-2026-22613
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...
EUVD-2026-22589
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network...
EUVD-2026-22536
Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network...
EUVD-2026-22462
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Shell allows an authorized attacker to elevate privileges locally...
EUVD-2026-22392
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally...
EUVD-2026-22394
Double free in Windows Shell allows an authorized attacker to elevate privileges locally...
CVE-2026-32225
Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-32202
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-32151
Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network...
CVE-2026-27918
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Shell allows an authorized attacker to elevate privileges locally...
CVE-2026-26166
Double free in Windows Shell allows an authorized attacker to elevate privileges locally...
CVE-2026-26165
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally...
composer: command injection via malicious Perforce repository definition
A flaw was found in Composer. Perforce::generateP4Command constructs shell commands by interpolating user-supplied Perforce connection parameters port, user, client without proper escaping, allowing an attacker to inject arbitrary commands through these values in a malicious composer.json declari...
composer: command injection via malicious Perforce source reference/url
A flaw was found in Composer. Perforce::syncCodeBase appends the $sourceReference parameter to a shell command without proper escaping, allowing an attacker to inject arbitrary commands through a crafted source reference containing shell metacharacters...
