EUVD-2026-118782

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands t...

CVE-2026-17408

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to multiple flaws that could allow a remote attacker to achieve arbitrary code execution . The root cause is the improper neutralization of special elements used in an OS command (CWE-78). This vulner...

CVE-2026-17402

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to OS command injection . The root cause is that user-supplied input is not properly neutralized before being passed to the operating system. This vulnerability could allow a remote authenticated att...

NUUO Camera <=20250203 - OS Command Injection

NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handleconfig.php, letting remote attackers execute arbitrary commands, exploit requires remote access. id: CVE-2025-1338 info: name: NUUO Camera =20250203 - OS Command Injection author: Ark...

Blue Angel Software Suite (5V Technologies) - OS Command Injection

Blue Angel 5V Technologies Blue Angel Software Suite through 20230920, as used in Analog Telephone Adapter ATA and Voice over IP VoIP devices, allows remote authenticated attackers to execute arbitrary OS commands as root via shell metacharacters in the pingaddr parameter to...

rConfig <= 3.9.4 - Authenticated OS Command Injection

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.9.4 does not properly sanitize the fileName POST parameter before using it in a shell command, allowing an authenticated attacker to inject arbitrary OS commands. This template uses default admin credentials to log in before triggering the...

Acmailer - Improper Access Control to OS Command Injection

Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows remote attackers to execute an arbitrary OS command, or gain an administrative privilege which may result in obtaining the sensitive information on the server via unspecified...

Group-Office < 26.0.5 - Remote Code Execution

Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmpfile into an exec call. By injecting shell metacharacters into...

WWBN AVideo Encoder < 7.0 - Unauthenticated OS Command Injection

AVideo 7.0 contains a command injection caused by shell command substitution in the base64Url GET parameter, letting unauthenticated attackers execute arbitrary OS commands, exploit requires no authentication. id: CVE-2026-29058 info: name: WWBN AVideo Encoder 7.0 - Unauthenticated OS Command...

MajorDoMo thumb.php - OS Command Injection

MajorDoMo aka Major Domestic Module before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager. id: CVE-2023-50917 info: name: MajorDoMo thumb.php - OS Command Injection author: DhiyaneshDK severity: critical...

WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection

A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection...

Pheditor 2.0.1-2.0.3 - OS Command Injection

Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges. id: CVE-2026-48030 info: name: Pheditor 2.0.1-2.0.3 - OS...

Palo Alto Networks Expedition - OS Command Injection

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls...

Node.js Embedded JavaScript 3.1.6 - Template Injection

Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settingsview optionsoutputFunctionName, which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation. id:...

CVE-2024-3400

CVE-2024-3400: OS Command Injection Vulnerability Description: CVE-2024-3400 is a security vulnerability affecting applications or services that accept user input and execute operating system commands based on that input without adequate validation. This vulnerability allows attackers to inject...

CVE-2026-33050

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands o...

GeoNode has OS command injection via uploaded file layer name

Arbitrary OS commands can be executed on the GeoNode by uploading a vector file with a crafted layer name...

EUVD-2026-118477

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands o...

CVE-2026-33050 GeoNode: OS command injection via uploaded file layer name

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands o...

CVE-2026-122193

OS command injection in the example SSM document provisioning script in Trusted Remote Execution REX before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Ced...