12946 matches found
CVE-2009-2776
SQL injection vulnerability in showresult.asp in Smart ASP Survey allows remote attackers to execute arbitrary SQL commands via the catid parameter...
CVE-2002-2047
The file preview functionality in Sketch 0.6.12 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an encapsulated Postscript EPS file...
CVE-2002-2040
The 1 phrafx and 2 phgrafx-startup programs in QNX realtime operating system RTOS 4.25 and 6.1.0 do not properly drop privileges before executing the system command, which allows local users to execute arbitrary commands by modifying the PATH environment variable to reference a malicious crttrap...
CVE-2002-1993
webbbspost.pl in WebBBS 4 and 5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the followup parameter...
CVE-2009-0622
Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A21.2 and Cisco ACE 4710 Application Control Engine Appliance before A18a allows remote authenticated users to execute arbitrary operating-system commands through a command...
Arbitrary Command Injection
Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the processFile function in the wxapkg File Parser component. An attacker can execute arbitrary system commands by providing crafted input to this function. Remediation There is no fixed version for...
CVE-1999-0255
Buffer overflow in ircd allows arbitrary command execution...
CVE-1999-0146
The campas CGI program provided with some NCSA web servers allows an attacker to execute arbitrary commands via encoded carriage return characters in the query string, as demonstrated by reading the password file...
CVE-1999-0766
The Microsoft Java Virtual Machine allows a malicious Java applet to execute arbitrary commands outside of the sandbox environment...
CVE-1999-0551
HP OpenMail can be misconfigured to allow users to run arbitrary commands using malicious print requests...
CVE-2025-4008
The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote...
CVE-2025-27804
Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions...
CVE-2025-48415
The eCharge Hardy Barth cPH2 and cPP2 electric vehicle charging stations (version 2.2.0 ) are affected by a USB backdoor feature. An attacker can trigger this backdoor by attaching a USB drive containing specially crafted salia.ini files. These files can contain commands that allow the attacker t...
CVE-2025-4008: Improper Neutralization of Special Elements used in a Command
The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote...
CVE-2025-48415: Exposed Dangerous Method or Function
A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contain several "commands" that could be exploited by an attacker to export or modify the device configuration, enable an SSH backdoor or perform other...
PT-2025-22344
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description A USB backdoor feature can be triggered by attaching a USB drive containing specially crafted salia.ini files. These files can contain commands that an attacker could exploit to export or modi...
VMware vCenter Server Command Injection
The vulnerability of the software for managing VMware vCenter Server lies in the lack of measures taken to neutralize the special elements used in the operating system’s command set. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...
TOTOLINK A3002R Command Injection Vulnerability
TOTOLINK A3002R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3002R suffers from a command injection vulnerability that stems from the FUN00459fdc function failing to properly filter constructed command special characters, commands, etc. The vulnerability can be...
CVE-2025-44881
The Wavlink WL-WN579A3 v1.0 wireless card is susceptible to a command injection vulnerability within the /cgi-bin/qos.cgi component. The root cause is unfiltered input , which allows an attacker to execute arbitrary commands via a crafted request. Exploitation of this flaw could lead to a total t...
