PT-2026-35646

A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50ABVY.7.1C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected...

PT-2026-35576

Name of the Vulnerable Software and Affected Versions dvladimirov MCP versions prior to 0.1.1 Description A command injection flaw exists in the Git Search API component within the GitSearchRequest function of the mcp server.py file. A remote attacker can execute this by manipulating the repo url...

MyMCP 注入漏洞

MyMCP is a tool developed by Eiliya’s individual developer, capable of executing multiple AI coding tasks simultaneously. MyMCP has a vulnerability that stems from an unknown function parameter in the codewithai component, specifically the operation workingdir/editablefiles. This operation leads ...

TOTOLINK A8000RU 命令注入漏洞

TOTOLINK A8000RU is a wireless router produced by TOTOLINK, a Chinese company. The TOTOLINK A8000RU 7.1cu.643b20200521 version contains a command injection vulnerability. This vulnerability stems from the setOpenVpnClientCfg function in the CGI Handler component, specifically the handling of the...

PT-2026-35691

A vulnerability was determined in Totolink A8000RU 7.1cu.643 b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enabled can lead to os command injection. The attack may be performed from...

CVE-2026-7202 Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection

A vulnerability has been found in Totolink A8000RU 7.1cu.643b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument wscDisabled leads to os command injection. The attack can be initiated remotely. The...

CVE-2026-7202

The CVE concerns Totolink A8000RU (firmware 7.1cu.643_b20200521). It affects the CGI Handler’s file /cgi-bin/cstecgi.cgi, in the function setWiFiWpsStart, where manipulating the argument wscDisabled enables OS command injection. Impact is high on confidentiality, integrity, and availability (per ...

CVE-2026-7202 Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection

A vulnerability has been found in Totolink A8000RU 7.1cu.643b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument wscDisabled leads to os command injection. The attack can be initiated remotely. The...

CVE-2026-7202

A vulnerability has been found in Totolink A8000RU 7.1cu.643b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument wscDisabled leads to os command injection. The attack can be initiated remotely. The...

EUVD-2026-25959

A vulnerability has been found in Totolink A8000RU 7.1cu.643b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument wscDisabled leads to os command injection. The attack can be initiated remotely. The...

CVE-2026-32649 Milesight Cameras OS Command Injection

A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras...

CVE-2026-32649

A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras...

EUVD-2026-25958

A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras...

CVE-2026-32649 Milesight Cameras OS Command Injection

A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras...

CVE-2026-32649

CVE-2026-32649 describes a command injection vulnerability in the web server of specific firmware versions on Milesight cameras. The affected surface is the camera web server, with the root cause stated as a command injection flaw. Impact metrics indicate high impact to confidentiality, integrity...

CVE-2026-7160

A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation of the argument datasize can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed...

python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API

A flaw was found in the Python webbrowser.open API. If a specially crafted URL containing "%action" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution...

CVE-2026-7160 Tenda HG3 formTracert command injection

A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation of the argument datasize can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed...

CVE-2026-7160 Tenda HG3 formTracert command injection

A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation of the argument datasize can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed...

CVE-2026-7160

The vulnerability CVE-2026-7160 affects the Tenda HG3 2.0 device. It resides in the function formTracert of the file /boaform/formTracert, where manipulating the datasize argument can lead to a command injection. The attack can be performed remotely, and the exploit has been publicly disclosed. T...