CVE-2026-8654

CVE-2026-8654 affects Delphix Continuous Data Connectors. The issue stems from improper input validation, allowing an authenticated user to execute arbitrary operating system commands on the staging or target host. The available documents do not specify affected versions, root cause details beyon...

EUVD-2026-30547

Oinone Pamirs 7.0.0 contains a command injection vulnerability in CommandHelper.executeCommands. The method starts a shell process and writes attacker-controlled command strings directly to the process standard input without sanitization. In affected deployments, this can result in arbitrary...

The vulnerability of the FortiAuthenticator identification system, related to deficiencies in access control, allows a perpetrator to execute arbitrary codes.

The vulnerability of the FortiAuthenticator identification system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary commands...

WS-2019-0471

Versions of rpc-websocket = 0.7.6 contain malicious code. The package opens a backdoor to a remote server and executes arbitrary commands, effectively acting as a backdoor...

WS-2019-0428

All versions of foever are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands...

WS-2019-0392

Axois is a malicious package designed to take advantage of users making a mistake when typing name of a module to install and eventually can lead to execution of arbitrary commands...

WS-2019-0265

Wizard-syncronizer, in all versions, is vulnerable to Command Injection. The package does not validate input on the cloneAndSync function and concatenates it to an exec call. This can be abused through a malicious widget containing the payload in the gitURL value or through a MITM attack since th...

WS-2019-0264

Cocos-utils is vulnerable in all version to Remote Code Execution. The unzip function concatenates user input to exec this can lead attackers to execute arbitrary commands on the server...

WS-2019-0262

Tomato, in all versions, is vulnerable to Command Injection. The /api/exec endpoint does not validate user input which allows attackers to run arbitrary commands in the system...

WS-2019-0131

expressfs does not validate user input on several API endpoints, allowing attackers to run arbitrary commands in the system. this command injection vulnerability exist in all versions...

PT-2026-51507

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.2 Description Multiple OS command injection flaws exist in the Custom MCP Server feature. An attacker with any account role or API access with view/update permissions for chatflows can execute arbitrary commands o...

📄 Apache HertzBeat 1.8.0 Remote Command Execution

Apache HertzBeat version 1.8.0 suffers from a remote command execution vulnerability via the scriptCommand parameter in a monitoring template definition. Exploit Title: Apache HertzBeat 1.8.0 - Remote Code Execution Google Dork: N/A Date: 2026-03-09 Exploit Author: Brett Gervasoni Vendor Homepage...

The vulnerability of the Cordon multi-purpose photoreceiver family, related to the failure to take measures to neutralize special elements, allows a intruder to execute arbitrary commands.

The vulnerability of the Cordon multi-purpose photoreceiver family is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow a remote-operating intruder to execute arbitrary commands...

CVE-2026-44861

SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into...

CVE-2026-44865

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-44862

SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into...

CVE-2026-44869

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-0242

A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploitation could allow an attacker to read sensitive data, modify database contents, and escalate privileges to gain full...

EUVD-2026-29986

A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

EUVD-2026-29961

A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support EoTS are not...