CVE-2021-47757: Unrestricted Upload of File with Dangerous Type

Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability in the backup restoration functionality. Authenticated attackers can upload a modified backup zip file with a malicious PHP shell to execute arbitrary system commands on the server...

CVE-2019-12165

MiCollab 7.3 PR2 7.3.0.204 and earlier, 7.2 7.2.2.13 and earlier, and 7.1 7.1.0.57 and earlier and MiCollab AWV 6.3 6.3.0.103, 6.2 6.2.2.8, 6.1 6.1.0.28, 6.0 6.0.0.61, and 5.0 5.0.5.7 have a Command Execution Vulnerability. Successful exploit of this vulnerability could allow an attacker to execu...

CVE-2025-3232

A remote unauthenticated attacker may be able to bypass authentication by utilizing a specific API route to execute arbitrary OS commands...

Codigo 代码注入漏洞

Codigo is a Markdown editor by the individual developer Alfonz Montelibano. A code injection vulnerability exists in Codigo version 1.0.1, which stems from the ability to execute arbitrary system commands that could lead to remote code execution...

CVE-2025-67744: Improper Control of Generation of Code

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security vulnerability exists in the Mermaid diagram rendering component that allows arbitrary JavaScript execution. Due to the exposure of the Electron IPC renderer...

FACTION 安全漏洞

Faction is an open source pen inspection report generation and evaluation collaboration framework from Faction Security. A security vulnerability exists in FACTION versions prior to 1.7.1 that stems from an extension execution path that allows untrusted extension code to execute arbitrary system...

CVE-2025-42892

CVE-2025-42892 describes an OS Command Injection in SAP Business Connector. An authenticated attacker with administrative privileges and adjacent network access can upload specially crafted content to the server; if processed, this can enable execution of arbitrary operating system commands and m...

CVE-2016-15048: Improper Neutralization of Special Elements used in an OS Command

AMTT Hotel Broadband Operation System HiBOS contains an unauthenticated command injection vulnerability in the /manager/radius/serverping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An...

CVE-2025-31342: Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals ESP Forum Module through 1.3 version allows remote authenticated users to execute arbitrary system commands via a malicious file...

Command Injection

Hoverfly is vulnerable to Command Injection. The vulnerability is due to improper input validation in the middleware endpoint due to the binary and script parameters being passed directly into a system without sanitization. This allows an attacker to supply crafted values for those parameters to...

CVE-2025-59481

A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell tmsh command that may allow an authenticated attacker with at least resource administrator role to execute arbitrary system commands with higher privileges. A successful exploit can allow the attacker to cross a security...

CVE-2025-60013: Improper Neutralization of Special Elements used in an OS Command

When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, arbitrary system commands may be executed, and the FIPS hardware security module HSM may fail to initialize. A successful exploit can allow the...

EUVD-2019-14747

Malware in sbrugna...

EUVD-2016-1289

Malware in sbrugna...

EUVD-2025-23925

Malicious code in bioql PyPI...

EUVD-2025-21021

Malicious code in bioql PyPI...

EUVD-2025-9519

Malicious code in bioql PyPI...

EUVD-2024-49097

Malicious code in bioql PyPI...

CVE-2025-54945: External Control of File Name or Path

An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path...

CVE-2025-54133 Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog

Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP Model Context Protocol deeplink handler, allowing attackers to execute 2-click arbitrary system commands through social engineering attacks. When...