The vulnerability of the FortiExtender signal booster’s microprogramming software arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of the FortiExtender signal booster software lies in the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Directory transversal vulnerability in Brocade Fabric OS before 9.2.1c2 and 9.2.2 through 9.2.2a using various shell commands (CVE-2025-58381)

A vulnerability in Brocade Fabric OS before 9.2.1c2 could allow an authenticated attacker with admin privileges using the shell commands “source, ping6, sleep, disown, wait to modify the path variables and move upwards in the directory structure or to traverse to different directories...

PT-2026-4924

Name of the Vulnerable Software and Affected Versions Victor CMS version 1.0 Description Victor CMS version 1.0 has a file upload issue. Authenticated users can upload malicious PHP files through the profile image upload feature. An attacker can upload a PHP shell to the /img directory and execut...

The vulnerability of Sangfor Endpoint Detection and Response (EDR) software lies in its failure to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary code.

The vulnerability of Sangfor Endpoint Detection and Response EDR software relates to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Privilege escalation via bind command in Brocade Fabric OS (CVE-2025-58383)

A vulnerability in Brocade Fabric OS versions before 9.2.1c2 could allow an administrator-level user to execute the bind command, to escalate privileges and bypass security controls allowing the execution of arbitrary commands...

MAL-2026-553 Malicious code in @snazah/davey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 236e7aae221a82bf01fa6f35766d0620cf72915540e8b589a91246d12706ba4d The package @snazah/davey was found to contain malicious code. Source: ghsa-malware bf3411f3e043990828ed141def8eac684a7942e9bbdfb6860c1f2a9c1e9e4a1b...

Malicious code in @snazah/davey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 236e7aae221a82bf01fa6f35766d0620cf72915540e8b589a91246d12706ba4d The package @snazah/davey was found to contain malicious code. Source: ghsa-malware bf3411f3e043990828ed141def8eac684a7942e9bbdfb6860c1f2a9c1e9e4a1b...

Malicious code in tripica-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2094e4c510f7d9f01acaf3dcdb4e2fda46afbe56f235d8168d81bcb984e52fc3 The package tripica-library was found to contain malicious code. Source: ossf-package-analysis...

BIT-PYTHON-MIN-2025-15367 POP3 command injection in user-controlled commands

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

BIT-PYTHON-2025-15367 POP3 command injection in user-controlled commands

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

BIT-PYTHON-2025-15366 IMAP command injection in user-controlled commands

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

BIT-LIBPYTHON-2025-15366 IMAP command injection in user-controlled commands

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

Apache Continuum vulnerable to Command Injection through Installations REST API

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the Installations REST API can use this to invoke arbitrary commands on the...

CVE-2016-15057

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can use this to invoke arbitrary commands on the...

EUVD-2016-10802

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can use this to invoke arbitrary commands on the...

CVE-2025-59091

Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying status information from and to the Access Managers. This information, among other things, is used to graphically...

CVE-2025-59091

CVE-2025-59091 affects the Kaba exos 9300 datapoint server used for relaying status information to Access Managers. The description across multiple sources indicates hard-coded credentials for four users that can sign in to the datapoint server on ports 1004/1005, enabling login to send/receive i...

CVE-2025-59091 Hardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 9300

Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying status information from and to the Access Managers. This information, among other things, is used to graphically...

CVE-2026-1428

Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server...

Cisco Unified Communications Manager command injection

Added: 01/26/2026 Background Cisco Unified Communications Manager is a product suite for managing voice and video communication and messaging. Problem A command injection vulnerability in multiple Cisco communications products could allow a remote attacker to execute arbitrary commands. Resolutio...