CVE-2013-10059 D-Link Routers tools_vct.htm OS Command Injection

An authenticated OS command injection vulnerability exists in various D-Link routers tested on DIR-615H1 running firmware version 8.04 via the toolsvct.htm endpoint. The web interface fails to sanitize input passed from the pingipaddr parameter to the toolsvct.htm diagnostic interface, allowing...

CVE-2013-10059 D-Link Routers tools_vct.htm OS Command Injection

An authenticated OS command injection vulnerability exists in various D-Link routers tested on DIR-615H1 running firmware version 8.04 via the toolsvct.htm endpoint. The web interface fails to sanitize input passed from the pingipaddr parameter to the toolsvct.htm diagnostic interface, allowing...

CVE-2013-10059

CVE-2013-10059 affects D-Link DIR-615H1 routers (firmware 8.04). An authenticated OS command injection exists in the tools_vct.htm diagnostic interface via the ping_ipaddr input, allowing arbitrary shell commands through backtick encapsulation. Exploitation can occur with default credentials on t...

PT-2025-31692 · Linksys · Linksys Routers +1

Name of the Vulnerable Software and Affected Versions: Linksys router versions v2.0.03 Description: An authenticated OS command injection vulnerability exists in various Linksys router models tested on WRT160Nv2. The web interface does not properly sanitize user-supplied input passed to the ping...

CVE-2013-10061: Improper Neutralization of Special Elements used in an OS Command

An authenticated OS command injection vulnerability exists in Netgear routers tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45 via the TimeToLive parameter in the setup.cgi endpoint. The vulnerability arises from improper input neutralization, enabling command injection...

CVE-2013-10060: Improper Neutralization of Special Elements used in an OS Command

An authenticated OS command injection vulnerability exists in Netgear routers tested on the DGN2200B model firmware versions 1.0.0.36 and prior via the pppoe.cgi endpoint. A remote attacker with valid credentials can execute arbitrary commands via crafted input to the pppoeusername parameter. Thi...

CVE-2013-10059: Improper Neutralization of Special Elements used in an OS Command

An authenticated OS command injection vulnerability exists in various D-Link routers tested on DIR-615H1 running firmware version 8.04 via the toolsvct.htm endpoint. The web interface fails to sanitize input passed from the pingipaddr parameter to the toolsvct.htm diagnostic interface, allowing...

CVE-2013-10050: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in multiple D-Link routers confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13 via the authenticated toolsvct.xgi CGI endpoint. The web interface fails to properly sanitize user-supplied input in the pingIp parameter, allowing attackers with valid...

CVE-2013-10049: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to properly sanitize user-supplied input in the timeZone paramet...

CVE-2013-10048: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 firmware ≤ 2.13 and ≤ 2.14b01, respectively—due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker c...

PT-2025-31686 · Raidsonic · Ib-Nas5220 +1

Name of the Vulnerable Software and Affected Versions: Raidsonic NAS devices versions IB-NAS5220 and IB-NAS4220 Description: An OS command injection issue exists due to improper sanitization of user-supplied input. The timeHandler.cgi API endpoint is vulnerable, allowing remote attackers to injec...

CVE-2025-54595: Improper Neutralization of Special Elements used in an OS Command

Pearcleaner is a free, source-available and fair-code licensed mac app cleaner. The PearcleanerHelper is a privileged helper tool bundled with the Pearcleaner application. It is registered and activated only after the user approves a system prompt to allow privileged operations. Upon approval, th...

CVE-2013-10058: Improper Neutralization of Special Elements used in an OS Command

An authenticated OS command injection vulnerability exists in various Linksys router models tested on WRT160Nv2 running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied input passed to the pingsize parameter during diagnostic...

CVE-2013-10037

An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdomain are passed directly to shell commands without sanitization. A remote unauthenticated attacker can exploit this flaw by sending a...

CVE-2013-10037 WebTester 5.x install2.php Unauthenticated Command Execution

An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdomain are passed directly to shell commands without sanitization. A remote unauthenticated attacker can exploit this flaw by sending a...

CVE-2013-10037

CVE-2013-10037 affects WebTester 5.x installed via install2.php. The cpusername, cppassword, and cpdomain parameters are passed directly to shell commands without sanitization, enabling remote unauthenticated command execution with web server privileges. Public references discuss existing exploit...

CVE-2013-10037 WebTester 5.x install2.php Unauthenticated Command Execution

An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdomain are passed directly to shell commands without sanitization. A remote unauthenticated attacker can exploit this flaw by sending a...

OS Command Injection

bun is vulnerable to OS Command Injection. The vulnerability is due to the failure to neutralize special characters in the $ shell API, allowing attackers to execute arbitrary commands through crafted input...

PT-2025-31813

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain versions 7.7.1.0 through 8.1.0.10 Dell PowerProtect Data Domain versions 7.13.1.0 through 7.13.1.25 Dell PowerProtect Data Domain versions 7.10.1.0 through 7.10.1.50 Description The Dell PowerProtect Data Domain...

VulnCheck KEV: CVE-2020-2034

An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if...