The vulnerability of the Policy Wizard (/wiz_policy_3_machine.php) web interface for managing D-Link DIR-615D router microprogramming software allows a perpetrator to escalate their privileges and execute arbitrary commands.

The vulnerability of the Policy Wizard /wizpolicy3machine.php web interface for managing D-Link DIR-615D router microprogramming software is related to the failure to take measures to neutralize special elements during the processing of the ipaddr parameter. Exploiting this vulnerability can allo...

CVE-2026-21418: Improper Neutralization of Special Elements used in an OS Command

Dell Unity, versions 5.5.2 and prior, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root...

TOTOLINK NR1800X Command Injection Vulnerability (CNVD-2026-11736)

TOTOLINK NR1800X is an outstanding 5G NR indoor Wi-Fi and SIP CPE from China's TOTOLINK. designed to provide fast and easy deployment of NR fixed data services in homes and offices. The TOTOLINK NR1800X suffers from a command injection vulnerability, which stems from a misuse of the parameter...

EUVD-2025-206573

aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugins/runcommand/postaction.php...

CVE-2025-51958

The aelsantex runcommand plugin for DokuWiki (version 2014-04-01 ) is vulnerable to arbitrary system command execution. The root cause is a flaw in the lib/plugins/runcommand/postaction.php file, which allows unauthenticated attackers to execute commands without any authentication. This vulnerabi...

The vulnerability of the D-Link D-View software platform for comprehensive network management lies in its lack of measures to neutralize specific elements, allowing attackers to execute arbitrary commands.

The vulnerability of the D-Link D-View software platform for comprehensive network management is related to an uncontrolled element in the search process. Exploiting this vulnerability could allow a hacker to execute arbitrary commands...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the buildCmd function. An attacker can execute arbitrary commands by supplying crafted values in the buildOptions structure, which are embedded unsafely in Makefile commands. Note: This is only exploitabl...

EUVD-2025-206536

The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the injected tag is interpreted by a shell, allowing execution of arbitrary commands with root privileges. Successful exploitation allows the attack...

TP-Link Archer RE605X security vulnerabilities

The TP-Link Archer RE605X is a wireless signal amplifier produced by the TP-Link company. The TP-Link Archer RE605X has a security vulnerability, which stems from the backup restoration function not properly verifying unexpected or unidentifiable tags in the backup files, potentially allowing for...

TeamViewer DEX Client 安全漏洞

TeamViewer DEX Client is a digital employee experience and endpoint management software from TeamViewer Germany. TeamViewer DEX Client suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the system...

The vulnerability of the setUnloadUserData() function in the script/cgi-bin/cstecgi.cgi of the TOTOLINK A7000R router’s microprogramming system allows a malicious user to execute arbitrary commands.

The vulnerability of the setUnloadUserData function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK A7000R router’s microprogramming system is related to the lack of measures taken at the control level during the processing of the pluginname parameter. Exploiting this vulnerability allows an...

Arbitrary Command Injection

Elysia is vulnerable to Arbitrary Command Injection. The vulnerability is due to unsanitized injection of dynamic cookie configuration into compiled routes, which allows an attacker with write access to the cookie configuration to inject and execute arbitrary code...

Tendenci security vulnerabilities

Tendenci is a membership management software developed by Tendenci Inc. in the United States, primarily used by non-profit organizations and associations. This software supports functions such as member management, content management, event management, and online donation management. Version 12.3...

CVE-2020-36962: Improper Neutralization of Formula Elements in a CSV File

Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when...

Arbitrary Command Injection

@orval/core is vulnerable to Arbitrary Command Injection. The vulnerability is due to improper handling and escaping of untrusted OpenAPI specification data in the x-enumDescriptions field during enum generation, which allows an attacker to inject and execute arbitrary TypeScript or JavaScript co...

[BSA-128] Security Update for incus

Mathias Gibbens uploaded new packages for incus which fixed the following security problems: CVE ID : CVE-2026-23953 CVE-2026-23954 Two security issues were discovered in Incus, a system container and virtual machine manager, which could result the in execution of arbitrary commands via malformed...

Arbitrary Command Injection

Overview org.apache.continuum:continuum is an Apache Continuum is an enterprise-ready continuous integration server with features such as automated builds, release management, role-based security, and integration with popular build tools and source control management systems. Affected versions of...

CVE-2026-1427 WellChoose｜Single Sign-On Portal System - OS Command Injection

Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server...

VulnCheck KEV: CVE-2016-15057

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can use this to invoke arbitrary commands on the...

WellChoose Single Sign-On Portal System has security vulnerabilities

WellChoose Single Sign-On Portal System is a single-sign-on portal system developed by WellChoose in Taiwan, China. The WellChoose Single Sign-On Portal System has a security vulnerability, which stems from OS command injection, potentially allowing for the execution of arbitrary OS commands...