EUVD-2026-92788

Langflow: OS command injection RCE via arbitrary command in MCP stdio server configuration...

CVE-2020-27976

CVE-2020-27976 漏洞利用 osCommerce Phoenix CE ）来结束您的PHP shell。在测试中，这产生了最佳结果。 payload中的换行符在上传前会被替换为空格。 ================== Sources: https://www.tenable.com/cve/CVE-2020-27976 https://herolab.usd.de/security-advisories/usd-2020-0026/...

CVE-2023-30854

WWBN Avideo 认证 RCE - 操作系统命令注入 CVE-2023-30854 WWBN Avideo sqlFile $objClone-cloneSiteURLvideos/cache/clones/$json-sqlFile"; $log-add"Clone 2 of $totalSteps: Geting MySQL Dump file"; exec$cmd . " 2&1", $output, $returnval; 我们可以通过管理面板的克隆站点功能控制 $objClone-cloneSiteURL。...

CVE-2026-35196

CVE-2026-35196 · Chamilo LMS · 操作系统命令注入 → RCE 研究人员： K 披露类型： 负责任披露 状态： 已修复 受影响产品： Chamilo LMS 2.0（已在 v1.11.32 上确认） 📋 漏洞摘要 字段| 详情 ---|--- 产品| Chamilo LMS 受影响版本| 2.0（已在 v1.11.32 上确认） 漏洞类型| 操作系统命令注入 CWE| CWE-78 — 对操作系统命令中特殊元素的中和不当 CVSSv3.1 评分| 8.8（高危） 向量| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H...

CVE-2020-2034-POC

CVE-2020-2034-POC 确定Palo Alto网络防火墙Global Protect Portal上运行的版本 最近Palo Alto Networks发布了许多关键漏洞，详见： https://security.paloaltonetworks.com/?severity=CRITICAL&product=PAN-OS&sort=-date 这是一个PoC，通过检查favicon和login.esp的curl扫描中的etag，来确定防火墙使用的版本。 参考： CWE-78影响： https://cwe.mitre.org/data/definitions/78 来自The...

CVE-2026-102256

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS...

CVE-2026-102256

A post-authentication OS Command Injection vulnerability (CWE-78) exists in the SonicWall SMA1000 appliance . This flaw allows a remote authenticated attacker with administrator privileges to execute arbitrary OS commands under specific conditions, leading to remote code execution (RCE). The vuln...

CVE-2026-102256

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS...

CVE-2026-102256

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS...

EUVD-2026-94325

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS...

blogpost_cve-2018-19987-analysis

CVE-2018-19987（D-Link 操作系统命令注入）分析 大家好！ 在这篇简短的博客文章中，我将详细拆解我所进行的一项快速分析，以更好地理解 CVE-2018-19987 背后的细节。起初我追踪这个 CVE 是因为我以为没有任何公开信息或漏洞利用。在进行初步分析后不久，我在 GitHub 上找到了两个公开的 PoC，你可以在这里和在这里找到它们。 由于我已经完成了大部分工作，并且没有找到完整的分析，我决定无论如何都要写这篇博客文章。 希望你喜欢！ 更新： 好吧……当我在这篇博客文章中遇到困难并进行谷歌搜索时，我发现了下面这篇文章，它描述了 D-Link DIR-818...

CVE-2026-106057

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106056

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...

CVE-2026-106058

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...

CVE-2026-106057

Versions of patool prior to 4.0.6 are vulnerable to an OS command injection vulnerability on Windows . The issue stems from the shell_quote_nt function failing to properly escape cmd.exe metacharacters or embedded double quotes within archive filenames. An attacker can exploit this by providing c...

CVE-2026-106057 patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106058 GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...

EUVD-2026-94306

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...

EUVD-2026-94305

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106057 patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...