93301 matches found
CVE-2026-91140 OS command injection in Progress Software Autonomous REST Connector GenAI Agents
An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...
CVE-2026-91140 OS command injection in Progress Software Autonomous REST Connector GenAI Agents
An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...
CVE-2026-91140
The Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 contains an OS command injection vulnerability (CWE-78) within its shell-based temporary-file cleanup instructions. An attacker can execute arbitrary commands on a developer's machine by providing a crafte...
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
Impact quote emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input: js quote'echo', 'ok',...
GHSA-PQG4-J6R4-53MV shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
Impact quote emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input: js quote'echo', 'ok',...
NPM: shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
NPM: shell-quote: quote command injection via a line terminator in a token after a comment token vulnerability discovered by ? in WordPress Npm shell-quote versions = 1.8.4, 1.11.0...
CVE-2026-105841 lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode
lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...
EUVD-2026-93393
lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...
CVE-2026-105841 lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode
lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...
CVE-2026-105841
The lrzsz utility, in versions before 0.13.0 , is vulnerable to an OS command injection in the lrz receive utility's pipe mode. The root cause is located in src/lrz.c, where the procheader() function passes unescaped ZMODEM/YMODEM filenames to popen() when running under a suffixed name like lrzta...
CVE-2026-105841
lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...
CVE-2026-39949
CVE-2026-39949: Authenticated Remote Code Execution in Cacti Through Host Variable Injection Summary An OS command injection vulnerability in Cacti ≤ 1.2.30 allows any authenticated user with device and graph template creation privileges to execute arbitrary commands on the underlying server. The...
CVE-2026-25089
🚨 CVE-2026-25089 - Critical OS Command Injection in FortiSandbox 📖 Overview CVE-2026-25089 is a critical OS Command Injection CWE-78 vulnerability affecting multiple Fortinet FortiSandbox deployments. An unauthenticated remote attacker can exploit this flaw by sending specially crafted HTTP...
CVE-2019-15107_detection
CVE-2019-15107detection This script determinate if a server is running a vulnerable version of Webmin. Webmin =1.920 command injection - CVE-2019-15107...
packetfence-CVE-2024-39024
About Security researcher: ly1g3, ly1g3attuta.io GPG fingerprint: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Overview: Remote Code Execution - Low level authenticated user to admin RCE CVE: CVE-2024-3924 Timeline: Discovered - ly1g3 Reported - ly1g3...
CVE-2026-82592
D-Link Router DIR-825M - تجاوز سعة المخزن المؤقت في /boafrm/formDiskFormat تفاصيل الثغرة معلومات تفصيلية الحقل| القيمة ---|--- البائع| D-Link المنتج| D-Link DIR-825M وطرازات أخرى تشارك نفس قاعدة كود البرنامج الثابت الإصدار المتأثر| البرنامج الثابت v1.1.8 نوع الثغرة| تجاوز سعة المخزن المؤقت على...
BIT-VIRTUALENV-2026-102937 virtualenv: Command injection via --prompt in activate.bat (batch activator)
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...
proofpoint-CVE-2023-0089
About Security researcher: ly1g3, ly1g3attuta.io GPG fingerprint: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Overview: Remote Code Execution - Low level authenticated user to admin RCE CVE: CVE-2023-0089 Timeline: Discovered - ly1g3 Reported - ly1g3...
patch-CVE-2026-14290
التصحيح: CVE-2026-14290 تفاصيل الثغرة CVE : CVE-2026-14290 المنتج : Palo Alto PAN-OS الوصف : حقن أوامر في GlobalProtect الخطورة : حرجة حالة التصحيح: تم النشر الحقل| القيمة ---|--- تاريخ التصحيح| 2026-05-20 الحالة| تم النشر نُشر إلى| بيئة الإنتاج تم التحقق من قبل| فريق SecOps المراجع NVD CISA KEV...