EUVD-2026-100521

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...

CVE-2026-48030

CVE-2026-48030 — OS Command Injection in Pheditor Overview Field| Details ---|--- CVE ID| CVE-2026-48030 Product| pheditor Vendor| Hamid Samak Affected Versions| 2.0.1, 2.0.2, 2.0.3 Patched Version| 2.0.4 Severity| Critical CVSS Score| 9.9 CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H...

EUVD-2026-100460

Improper neutralization of special elements used in a command 'command injection' in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network...

CVE-2026-97781

A command injection vulnerability exists in Microsoft Office OneNote due to the improper neutralization of special elements used in a command. This flaw allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability is rated with a High severity (CVSS 8.8) and ...

EUVD-2026-100318

Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...

CVE-2026-100207

A vulnerability in Azure CycleCloud involving improper neutralization of special elements used in an OS command (OS command injection) allows an authorized attacker to execute code locally . This flaw is associated with CWE-78 and has a CVSS 3.1 base score of 7.3 . While the vulnerability was ide...

EUVD-2026-100274

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-96951

The Windows Shell is vulnerable to a security feature bypass (CVE-2026-96951) caused by improper neutralization of special elements used in a command (command injection). This flaw affects Windows 10 , Windows 11 , and certain Server versions , and was also identified in Outlook.com cloud service...

CVE-2026-69718

A command injection vulnerability exists in Windows Update due to the improper neutralization of special elements used in a command. This flaw allows an authorized attacker to achieve local privilege escalation . No specific exploit information or code is provided in the documents. Remediation in...

EUVD-2026-99068

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-69370

Visual Studio Code is vulnerable to a command injection flaw due to the improper neutralization of special elements used in a command. This vulnerability allows an unauthorized attacker to achieve remote code execution over a network. While the impact is high, specific details regarding the vulne...

sqlite-cli-go

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · sqlite-cli-go sqlite-cli-go Class: Command injection Reach: Local SQLite 3.53.4 b09c88c default sqlite3 CLI still treats SQL Server go and Oracle / as statement terminators. lineiscommandterminator rewrites that line ...

CVE-2026-110236 KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

CVE-2026-110233

The rovr tool (versions through 0.10.3 ) on Windows is vulnerable to an OS command injection vulnerability. The root cause is an unquoted path to cmd.exe triggered when the application opens a file via the open_file function. Attackers can exploit this by providing a file name containing shell me...

CVE-2026-110233 rovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe

Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opene...

CVE-2026-110233 rovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe

Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opene...

PDFkit-CMD-Injection-CVE-2022-25765

PDFkit-CMD-Injection CVE-2022-25765 Exploit for CVE-2022-25765 command injection in pdfkit 0.8.6 See more details about the vulnerability here PoC Run the netcat on your host: $ nc -lvnp 1337 Run the exploit example: $ ./CVE-2022-25765.py -t http://localhost -a 10.10.14.122 -p 1337 Input target...

CVE-2026-106171

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege via specially crafted packets...

rpm: Command Injection in `rpmbuild -t*` (`getTarSpec`) via Unescaped Tarball Path

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2020-2038

CVE-2020-2038 Exploit to capitalize on vulnerability CVE-2020-2038. According to Palo Alto Networks: An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS...