CVE-2026-87898

A critical OS command injection vulnerability in Plesk allows remote authenticated users to execute arbitrary code with root privileges . The vulnerability has a CVSS 4.0 base score of 9.4 . While technical details regarding the specific vulnerable component or root cause are not explicitly provi...

EUVD-2026-85618

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

Summary An authenticated user can execute arbitrary operating system commands on the openc3-cosmos-cmd-tlm-api service. The pypiurl setting is interpolated, unescaped, into a command line that is run through a shell backtick when a plugin is installed. Shell metacharacters in the setting value ar...

CVE-2026-77601 OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...

CVE-2026-93349

Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters ...

CVE-2026-93349 Frictionless OS Command Injection via explore Console Command

Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters ...

CVE-2026-93349

Frictionless versions through 5.20.0rc1 are vulnerable to an OS command injection in the explore console command. The root cause is the unsanitized passing of resource path values from a datapackage.json descriptor to os.system via a shell. An attacker can supply a crafted descriptor containing s...

CVE-2026-93349 Frictionless OS Command Injection via explore Console Command

Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters ...

CVE-2026-35196

CVE-2026-35196 · Chamilo LMS · Inyección de Comandos del SO → RCE Investigador: K Tipo de Divulgación: Divulgación Responsable Estado: Parcheado Producto Afectado: Chamilo LMS 2.0 Confirmado en v1.11.32 📋 Resumen de Vulnerabilidad...

CVE-2026-15027

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer...

CVE-2026-15027 Changing｜CGServiSign - OS Command Injection

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer...

CVE-2026-15027

The CGServiSign software developed by Changing contains an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this by inducing victims to visit a malicious web page, which then triggers the injection of arbitrary OS commands through the local service interface . This...

Simulation_CVE-2024-46256

CVE-2024-46256 y CVE-2024-46257 – Simulación de PoC Resumen Este repositorio contiene una Prueba de Concepto PoC paso a paso y respaldada por imágenes que simula dos vulnerabilidades en Nginx Proxy Manager que permiten inyección de comandos del sistema operativo, lo que conduce a ejecución remota...

EUVD-2026-84985

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr...

EUVD-2026-84977

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-84972

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-84975

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection...

EUVD-2026-84973

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-94367

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr...

CVE-2026-80425: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...