CVE-2021-31630-OpenPLC-3-Authenticated-RCE

CVE-2021-31630 OpenPLC 3 WebServer Authenticated Remote Code Execution. Description The presence of Command Injection in Open PLC Webserver v3 enables remote attackers to run arbitrary code by exploiting the "Hardware Layer Code Box" component found on the "/hardware" page of the application. Onl...

CVE-2021-46422

CVE-2021-46422 OS Command Injection in South Korean Wireless Routers Installation git clone https://github.com/kelemaoya/CVE-2021-46422.git cd CVE-2021-46422 pip3 install -r requirements.txt Usage Single URL pocsuite -r ../CVE-2021-46422.py -u url --verify Batch URLs pocsuite -r...

CVE-2023-36143

CVE-2023-36143 Maxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool" functionality of the device...

CVE-2026-108546

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

CVE-2026-108546

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

CVE-2026-108161

FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...

CVE-2026-108546 Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

CVE-2026-108546 Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

EUVD-2026-96341

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

CVE-2026-108546

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

CVE-2026-108546

Spotweb through version 1.5.8 is vulnerable to an OS command injection vulnerability within the runcommand NZB handler . The root cause is the unescaped substitution of shell metacharacters in a spot title for the $SPOTTITLE variable, which is subsequently passed to the exec() function. Remote at...

CVE-2026-108546 Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

EUVD-2026-96316

FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...

CVE-2026-108161

FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...

CVE-2026-108161 FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download

FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...

CVE-2026-108161

FusionPBX versions through 5.6.5 are vulnerable to an OS command injection in the call_recordings::download() function. When the record_name filename template is enabled, unauthenticated attackers can execute commands as the web server user by providing malicious Caller-ID values (e.g., using she...

CVE-2026-108161 FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download

FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...

CVE-2023-0669

CVE-2023-0669 CVE-2023-0669 GoAnywhere MFT command injection vulnerability...

Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws

Anthropic on Friday said it's cutting off live internet access for all its internal evaluations until further notice following the discovery of new incidents in which its artificial intelligence AI models exhibited misaligned behavior and targeted real websites. The AI company said it identified...

cve-2022-36804

CVE-2022-36804: RCE pre-autenticazione in Atlassian Bitbucket Server Una vulnerabilità critica di command injection è stata trovata in molteplici endpoint API di Atlassian Bit bucket Server e Data center. Questa vulnerabilità riguarda tutte le versioni di Bitbucket Server e Data Center rilasciate...