CVE-2022-51019

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2022-51019

Akaunting versions prior to 2.1.31 are vulnerable to an OS command injection vulnerability within the module installation and update flow. The root cause is the unvalidated passing of the alias parameter to shell command execution. Authenticated users with admin panel access can exploit this by i...

CVE-2022-51019 Akaunting before 2.1.31 OS Command Injection via app alias

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

EUVD-2022-56062

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2022-51019 Akaunting before 2.1.31 OS Command Injection via app alias

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2022-51019 Akaunting before 2.1.31 OS Command Injection via app alias

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2015-10141

CVE-2015-10141 – Ejecución Remota de Código RCE en XDebug CVE-2015-10141 es una vulnerabilidad de inyección de comandos del sistema operativo sin autenticación que afecta a las versiones 2.5.5 y anteriores de Xdebug. Causa raíz: Cuando la función de depuración remota de Xdebug está habilitada, la...

CVE-2026-82973

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via...

CVE-2026-102437

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

CVE-2026-82804 Apache DolphinScheduler: Command Injection in the Alert Script Plugin

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

CVE-2026-82804 Apache DolphinScheduler: Command Injection in the Alert Script Plugin

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

CVE-2026-82804

The Apache DolphinScheduler (versions before 3.4.3 ) is vulnerable to command injection in the Alert Script plugin . The root cause is the incorporation of the scriptPath parameter into a /bin/sh -c command without sufficient neutralization of shell metacharacters. An authenticated user can explo...

CVE-2026-82973 Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via...

EUVD-2026-88759

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via...

CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

CVE-2026-102437

The esengine DeepSeek-Reasonix (Reasonix Studio) desktop application contains an OS Command Injection vulnerability in the internal/gitcmd component. The root cause is the improper neutralization of special elements during the invocation of git diff filter.clean/smudge . A local attacker who can ...

EUVD-2026-88756

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

Netcore NR289-GE CVE-2026-101072 ap_ip.cgi RCE

Exploits CVE-2026-101072 via POST /x.ico/apip.cgi on Netcore NR289-GE AC controllers. The ip form field breaks out of a wget --post-data shell command. Requires a bound AP MAC; payload length is limited to 19 bytes. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore NR289-GE CVE-2026-101072...