CVE-2026-76866: Improper Neutralization of Argument Delimiters in a Command

Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSsetcgi.c and related ddnsProc.c components, enabling os command argument injection. Attackers can exploit the unsanitized parameters to inject additional command arguments...

CVE-2026-76862: Improper Neutralization of Argument Delimiters in a Command

Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launch paths, including ntoolsstartsetcgi, ntoolstcpdumpstartsetcgi, exedefault, and ntoolsproc components. Attackers can inject crafted arguments into these tcpdump launch routines ...

CVE-2010-1423: Improper Neutralization of Special Elements used in an OS Command

Argument injection vulnerability in the URI handler in a Java NPAPI plugin and b Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the 1 -J or 2 -XXaltjvm argument to javaws.exe...

CVE-2009-4025: Improper Neutralization of Special Elements used in an OS Command

Argument injection vulnerability in the traceroute function in Traceroute.php in the NetTraceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-4673: Improper Neutralization of Special Elements used in an OS Command

Argument injection vulnerability in Apple QuickTime 7.2 for Windows XP SP2 and Vista allows remote attackers to execute arbitrary commands via a URL in the qtnext field in a crafted QTL file. NOTE: this issue may be related to CVE-2006-4965 or CVE-2007-5045...