CVE-2025-25067: Improper Neutralization of Special Elements used in an OS Command

mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands...

CVE-2021-35028

A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to execute arbitrary OS commands...

CVE-2024-52324

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands...

CVE-2024-1522

A Cross-Site Request Forgery CSRF vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the /executecode API endpoint, which does not properly validate requests, enabling an attacker to craft a...

PT-2025-7049

Name of the Vulnerable Software and Affected Versions mySCADA myPRO Manager affected versions not specified Description The issue exists due to the lack of measures to neutralize special elements, which could allow a remote attacker to execute arbitrary OS commands. This is an OS command injectio...

OS Command Injection

github.com/mayuresh82/gocast is vulnerable to OS Command Injection. The vulnerability is due to improper validation of user input in the name parameter, which allows specially crafted HTTP requests to inject and execute arbitrary OS commands...

PT-2025-4862

Name of the Vulnerable Software and Affected Versions UD-LT2 firmware versions 1.00.008 SE and earlier Description An issue exists due to the improper neutralization of special elements used in an OS command, allowing for the execution of arbitrary OS commands if a user logs in to the CLI of the...

CVE-2023-37777: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Synnefo Internet Management Software IMS version 2023 and earlier. This vulnerability occurs due to improper input validation in a specific API endpoint parameter allowing an attacker to manipulate SQL queries via crafted input. Successful exploitation coul...

CVE-2025-0457: Improper Neutralization of Special Elements used in an OS Command

The airPASS from NetVision Information has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands...

CVE-2025-0356: Improper Neutralization of Special Elements used in an OS Command

NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands via the network...

CVE-2024-51442

Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlna.conf configuration file...

CVE-2024-51442

Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlna.conf configuration file...

PT-2024-17685

Name of the Vulnerable Software and Affected Versions TenderDocTransfer from Chunghwa Telecom affected versions not specified Description The application has a Reflected Cross-site scripting vulnerability. It sets up a simple local web server and provides APIs for communication with the target...

CVE-2024-52324

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands...

CVE-2024-52324 Ruijie Reyee OS Use of Inherently Dangerous Function

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands...

CVE-2024-52324: Use of Inherently Dangerous Function

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands...

CVE-2024-47133: Improper Neutralization of Special Elements used in an OS Command

UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier allow a remote authenticated attacker with an administrative account to execute arbitrary OS commands...

PT-2024-9440

Name of the Vulnerable Software and Affected Versions: I-O Data Device UD-LT1 versions 2.1.8 and earlier I-O Data Device UD-LT1/EX versions 2.1.8 and earlier Description: The issue exists due to the inclusion of undocumented features, which can be exploited by a remote attacker to disable the...

VulnCheck KEV: CVE-2024-52564

Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware Ver.2.1.8 and earlier and UD-LT1/EX firmware Ver.2.1.8 and earlier. A remote attacker may disable the firewall function of the affected products. As a result, an arbitrary OS command may be executed and/or...

CVE-2024-52803

CVE-2024-52803 affects LLama Factory, where the training process is vulnerable to a remote OS command injection due to insecure use of Popen with shell=True and unsanitized user input. The issue allows an attacker to execute arbitrary OS commands on the host, with impact described as high for con...