CVE-2026-21267 Dreamweaver Desktop | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue requires user interaction in that a victim...

SAP Application Server for ABAP: Operating System Command Injection Vulnerability

SAP Application Server for ABAP is a load balancing, memory management platform from SAP, Germany. SAP Application Server for ABAP suffers from an operating system command injection vulnerability that stems from OS command injection, which could lead to an authenticated attacker uploading special...

PT-2026-2767

Name of the Vulnerable Software and Affected Versions Dreamweaver Desktop versions 21.6 and earlier Description Dreamweaver Desktop versions 21.6 and earlier are susceptible to an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' issue. Successful exploitati...

Merit LILIN IP Camera Series: Operating System Command Injection Vulnerability

The Merit LILIN IP Camera Series is a series of IP video recorders from Merit LILIN of Taiwan, China. The Merit LILIN IP Camera Series suffers from an operating system command injection vulnerability that stems from OS command injection, which could allow an authenticated, remote attacker to inje...

PT-2026-2044

Name of the Vulnerable Software and Affected Versions Merit LILIN DVR/NVR models affected versions not specified Merit Lilin DH032 affected versions not specified Description An authenticated remote attacker can inject arbitrary OS commands on Merit LILIN DVR/NVR devices and execute them. This is...

CVE-2025-46645

Dell PowerProtect Data Domain with DD OS is affected by OS Command Injection due to improper neutralization of special elements. A high-privilege attacker with remote access could execute commands, potentially impacting confidentiality, integrity, and availability as described. Affected releases ...

CVE-2025-46644

Dell PowerProtect Data Domain (DD OS) affected ranges: Feature Release 7.7.1.0–8.4.0.0, LTS2025 8.3.1.10, LTS2024 7.13.1.0–7.13.1.40, LTS2023 7.10.1.0–7.10.1.70. Description: OS Command Injection vulnerability due to improper neutralization of special elements in commands. Impact: a highly privil...

EUVD-2026-0897

In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Centreon Infra Monitoring Backup configuration in the administration setup...

CVE-2025-64124

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Nuvation Energy Multi-Stack Controller MSC allows OS Command Injection.This issue affects Multi-Stack Controller MSC: before 2.5.1...

CVE-2025-64120

CVE-2025-64120 affects the Nuvation Energy Multi-Stack Controller (MSC). The vulnerability is caused by improper neutralization of special elements in OS command handling, enabling an OS command injection. Affected versions are MSC 2.3.8 up to, but not including, 2.5.1 (i.e., 2.3.8–2.5.0). Impact...

CVE-2023-53872 Wp2Fac 1.0 OS Command Injection via send.php Endpoint

Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&' operators to execute malicious code...

CVE-2023-53872

Wp2Fac 1.0 has an OS command injection vulnerability in the send.php endpoint. The vulnerability allows remote attackers to execute arbitrary system commands by injecting shell commands through the numara parameter (using & to chain commands). Impact is described as high for confidentiality, inte...

EUVD-2025-202724

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the actiondealupdate in file /usr/lib/lua/luci/controller/api/rcmsAPI.lua...

CVE-2025-56120

OS Command Injection vulnerability in Ruijie X60 PRO X6010212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devconfig/configretain.lua...

CVE-2025-56117

OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V109241521 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devsta/nbrcwmp.lua...

CVE-2025-56118

OS Command Injection vulnerability in Ruijie X60 PRO X6010212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devsta/nbrcwmp.lua...

CVE-2025-56111

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the networksetwanconf in file /usr/lib/lua/luci/controller/admin/netport.lua...

CVE-2025-56109

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the actionwireless in file /usr/lib/lua/luci/control/admin/wireless.lua...

CVE-2025-56092

The Ruijie X30 PRO V1 (firmware version X30-PRO-V1_09241521 ) is vulnerable to an OS Command Injection vulnerability. The flaw exists in the module_get function within the file /usr/local/lua/dev_sta/networkConnect.lua due to unvalidated input. Attackers can exploit this by sending a crafted POST...

CVE-2025-56130

The Ruijie RG-S1930 network management switch, specifically version S1930SWITCH_3.0(1)B11P230 , is susceptible to an OS Command Injection vulnerability. The root cause is the improper handling of a specially crafted POST request to the module_update function within the file /usr/local/lua/dev_con...