CVE-2016-15047: Improper Neutralization of Special Elements used in an OS Command

AVTECH devices that include the CloudSetup.cgi management endpoint are vulnerable to authenticated OS command injection. The exefile parameter in CloudSetup.cgi is passed to the underlying system command execution without proper validation or whitelisting. An authenticated attacker who can invoke...

CVE-2025-60006: Improper Neutralization of Special Elements used in an OS Command

Multiple instances of an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the CLI of Juniper Networks Junos OS Evolved could be used to elevate privileges and/or execute unauthorized commands. When an attacker executes crafted CLI commands,...

CVE-2025-11491

CVE-2025-11491 affects wonderwhy-er DesktopCommanderMCP up to 0.2.13. The vulnerability is in CommandManager (src/command-manager.ts) where manipulation enables operating system command injection. Attacks can be initiated remotely, and public exploits exist. Connected sources do not provide a con...

CVE-2025-57457

The Curo UC300 video phone, specifically version 5.42.1.7.1.63R1 , is vulnerable to an OS Command Injection vulnerability in its Admin panel. The flaw is caused by an unvalidated IP Addr parameter, which allows local attackers to execute arbitrary Linux commands on the device. To exploit this, an...

CVE-2025-11490: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection. The attack may be performed from...

CVE-2025-57457: Improper Neutralization of Special Elements used in an OS Command

An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter...

PT-2025-41301

Name of the Vulnerable Software and Affected Versions Curo UC300 version 5.42.1.7.1.63R1 Description A flaw exists within the Admin panel that permits local attackers to inject arbitrary OS Commands. The injection occurs through the IP Addr parameter. Recommendations At the moment, there is no...

CVE-2025-11491: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made...

PT-2025-41303

Name of the Vulnerable Software and Affected Versions wonderwhy-er DesktopCommanderMCP versions through 0.2.13 Description A flaw exists in the CommandManager function within the src/command-manager.ts file that allows for operating system command injection. This issue can be triggered remotely...

EUVD-2025-33285

An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter...

CVE-2025-36566

Dell PowerProtect Data Domain with Data Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an ...

CVE-2025-11407 D-Link DI-7001 MINI upgrade_filter.asp os command injection

A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgradefilter.asp. This manipulation of the argument path causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could b...

CVE-2025-36569

Dell PowerProtect Data Domain with Data Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an ...

CVE-2025-36569

Dell PowerProtect Data Domain with Data Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an ...

CVE-2025-36567

Dell PowerProtect Data Domain (DD OS) is affected by an OS Command Injection vulnerability due to improper neutralization of special elements in commands. A high-privilege local attacker could execute arbitrary commands and potentially escalate to root on DD OS Feature Release 7.7.1.0–8.1.0.10, L...

CVE-2025-43908

Dell PowerProtect Data Domain (DD OS) is affected by an OS Command Injection vulnerability in Feature Release 7.7.1.0–8.3.0.15, LTS2025 8.3.1.0, LTS2024 7.13.1.0–7.13.1.30, and LTS2023 7.10.1.0–7.10.1.60. The issue arises from improper neutralization of special elements in OS commands, potentiall...

CVE-2025-43911

Dell PowerProtect Data Domain with Data Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Neutralizatio...

CVE-2025-43890

Dell PowerProtect Data Domain with Data Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Neutralizatio...

CVE-2025-43911

Dell PowerProtect Data Domain (DD OS) feature releases and LTS lines are affected by an OS command injection vulnerability in multiple versions, caused by improper neutralization of special elements in OS commands. A high-privilege attacker with local access could achieve arbitrary command execut...

EUVD-2025-32858

Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is related ...