93975 matches found
rubygem-hammer_cli: command injection via insecure editor invocation
A flaw was found in rubygem-hammercli. A command injection vulnerability exists in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system method. By passing a single interpolated...
rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter
A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...
CVE-2026-79898
Fortra BoKS Manager contains a command injection vulnerability in the crlserver component. An authenticated user with permission to add CRL URLs via BCC , the WSI REST or SOAP API , or the cacrl command-line interface can trigger shell command substitution. This allows the attacker to execute com...
CVE-2026-79898 Fortra BoKS Manager crlserver command injection vulnerability
Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...
EUVD-2026-90875
Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...
CVE-2026-79898 Fortra BoKS Manager crlserver command injection vulnerability
Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...
CVE-2022-33891-EXPLOIT
CVE-2022-33891 - Apache Spark UI Remote Code Execution RCE π Apache Spark UI is susceptible to a remote command injection vulnerability identified as CVE-2022-33891. This flaw arises due to improper handling of user authentication and access control, specifically when Access Control Lists ACLs ar...
CVE-2024-3273-EXPLOIT
CVE-2024-3273 - D-Link Remote Code Execution RCE π₯ A critical vulnerability, classified as CVE-2024-3273, was discovered in several D-Link NAS devices, including DNS-320L, DNS-325, DNS-327L, and DNS-340L, up to the date of 20240403. This vulnerability affects an unknown function of the file...
CVE-2024-10914-EXPLOIT
CVE-2024-10914 - D-Link Remote Code Execution RCE This repo contains a proof-of-concept PoC exploit for a critical vulnerability affecting D-Link NAS devices. The bug, tracked as CVE-2024-10914 , impacts the following models: D-Link DNS-320 D-Link DNS-320LW D-Link DNS-325 D-Link DNS-340L The...
CVE-2022-34753-EXPLOIT
CVE-2022-34753 - OS Command Injection in SpaceLogic C-Bus Home Controller CVE-2022-34753 is a critical security vulnerability classified under CWE-78, indicating an "Improper Neutralization of Special Elements used in an OS Command" commonly referred to as 'OS Command Injection'. This vulnerabili...
CVE-2026-103431
colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted proce...
CVE-2026-76146
An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely...
CVE-2026-76146 Genians, Inc Genian SSL PNS OS Command Injection
An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely...
EUVD-2026-90488
An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely...
CVE-2026-76146
Genian SSL PNS is subject to an OS command injection vulnerability. An attacker who possesses only the client access ID , without requiring a password, can execute arbitrary commands remotely. No specific remediation details or exploit links were provided in the documentation.
CVE-2026-76146 Genians, Inc Genian SSL PNS OS Command Injection
An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely...
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data. LevelBlue's Threat Hunt Operations & Research THOR team, which analyzed the...
PT-2026-103951
Name of the Vulnerable Software and Affected Versions TP-Link TL-WR841N affected versions not specified Description An authenticated OS command injection exists in the IPv6 WAN configuration. This occurs when a crafted value provided to the IPv6 Gateway is improperly incorporated into a system...
CVE-2026-12542: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not...
PT-2026-103902
Name of the Vulnerable Software and Affected Versions Fortra BoKS Manager affected versions not specified Description An authenticated user with permissions to add CRL URLs can trigger shell command substitution. This occurs when using the BCC, the WSI REST or SOAP API, or the cacrl command-line...