CVE-2026-16283

The software oPanel by Osbil Technology Ltd. is susceptible to an OS command injection vulnerability. This issue arises from the improper neutralization of special elements used in OS commands. The vulnerability specifically affects versions before 1.20.66 . The provided documents do not specify ...

EUVD-2026-120057

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Osbil Technology Ltd.Osbil Technology Ltd. OPanel allows OS Command Injection. This issue affects oPanel: before 1.20.66...

CVE-2026-94434

The Pardus Boot Repair software, developed by TÜBİTAK BİLGEM Software Technologies Research Institute, contains an OS command injection vulnerability. This flaw arises from the improper neutralization of special elements used in an OS command. The vulnerability affects versions from 1.0.8 before ...

CVE-2026-94434

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9...

EUVD-2026-120036

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9...

CVE-2026-124585

A vulnerability exists in the Web Administration Interface of Chengdu Feiyuxing Technology VW2100 and VEC10GP (version 1.0 B-MB3W202-210825-r11775). The flaw resides in the add_expmac function within the var/html/webserver file. By manipulating the mac argument, an attacker can perform a remote O...

EUVD-2026-119884

A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function addexpmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. T...

CVE-2026-124580

A critical OS command injection vulnerability exists in the Weixin Auth Endpoint component of Chengdu Feiyuxing Technology products, specifically the VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775 . The flaw is located in the handle_wechat_cn_wifi function within the var/html/webserver file. Atta...

EUVD-2026-119876

A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handlewechatcnwifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The...

Group-Office < 26.0.5 - Remote Code Execution

Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmpfile into an exec call. By injecting shell metacharacters into...

WWBN AVideo Encoder < 7.0 - Unauthenticated OS Command Injection

AVideo 7.0 contains a command injection caused by shell command substitution in the base64Url GET parameter, letting unauthenticated attackers execute arbitrary OS commands, exploit requires no authentication. id: CVE-2026-29058 info: name: WWBN AVideo Encoder 7.0 - Unauthenticated OS Command...

Blue Angel Software Suite (5V Technologies) - OS Command Injection

Blue Angel 5V Technologies Blue Angel Software Suite through 20230920, as used in Analog Telephone Adapter ATA and Voice over IP VoIP devices, allows remote authenticated attackers to execute arbitrary OS commands as root via shell metacharacters in the pingaddr parameter to...

Acmailer - Improper Access Control to OS Command Injection

Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows remote attackers to execute an arbitrary OS command, or gain an administrative privilege which may result in obtaining the sensitive information on the server via unspecified...

MajorDoMo thumb.php - OS Command Injection

MajorDoMo aka Major Domestic Module before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager. id: CVE-2023-50917 info: name: MajorDoMo thumb.php - OS Command Injection author: DhiyaneshDK severity: critical...

Chaosblade < 1.7.4 - Remote Code Execution

exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without authentication. id: CVE-2023-47105 info: name: Chaosblade 1.7.4 - Remote Code Execution author: s4e-io severity: high description: | exec.CommandContext in...

Pheditor 2.0.1-2.0.3 - OS Command Injection

Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges. id: CVE-2026-48030 info: name: Pheditor 2.0.1-2.0.3 - OS...

Node.js Embedded JavaScript 3.1.6 - Template Injection

Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settingsview optionsoutputFunctionName, which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation. id:...

WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection

A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection...

CVE-2026-110273

IBM TRIRIGA Application Platform 5.0.0 through 5.0.9 IBM TRIRIGA could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-110273 Security Vulnerability identified in IBM TRIRIGA - Command Execution

IBM TRIRIGA Application Platform 5.0.0 through 5.0.9 IBM TRIRIGA could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...