CVE-2026-16469: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-94490: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system.py of the component Command API. Performing a manipulation of the argument command results in os command injection. It is possible to...

CVE-2026-43641: Improper Neutralization of Special Elements used in an OS Command

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can...

Linux Distros Unpatched Vulnerability : CVE-2026-53534

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the G...

CVE-2025-69212_PoC

CVE-2025-69212: OpenSTAManager 概念実証（PoC） このリポジトリは、OpenSTAManager 内で特定された脆弱性 CVE-2025-69212 を実証する概念実証（PoC）です。この脆弱性は、P7M（署名付き XML）ファイルのデコード機能に起因する OS コマンドインジェクションです。影響を受けるバージョンは 2.9.8 およびそれ以前です。 説明 CVE-2025-69212 は OpenSTAManager で発見されたセキュリティ脆弱性です。この PoC...

CVE-2026-61852

Chartbrew (open-source charting web app) prior to 5.2.2 is vulnerable to SQL injection in its AI runQuery() tool (server/modules/ai/orchestrator/tools/runQuery.js). The row_limit parameter is interpolated into a SQL LIMIT clause without integer validation; because the read-only keyword check exec...

CVE-2026-61852 Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

CVE-2025-69212-PoC

CVE-2025-69212 OpenSTAManager = 2.9.8 — P7M 파일 처리 과정에서의 OS 명령어 삽입 개요...

CVE-2026-69212

CVE-2025-69212 — OpenSTAManager OS コマンドインジェクション RCE CVE-2025-69212 の概念実証エクスプロイトです。これは OpenSTAManager = 2.9.8 の OS コマンドインジェクション脆弱性であり、認証された攻撃者が悪意を持って細工された ZIP ファイルのアップロードを介してリモートコード実行を達成することを可能にします。 アドバイザリー CVE: CVE-2025-69212 GHSA: GHSA-25fp-8w8p-mx36 影響を受けるバージョン: OpenSTAManager = 2.9.8 修正バージョン:...

cve-2025-11142-axis-mediaclip-rce

CVE-2025-11142 — AXIS mediaclip.cgi OSコマンドインジェクション n-day調査レポート＆PoC — CVSS 7.1のOSコマンドインジェクション脆弱性（AXIS VAPIX Media Clip API）に対するパッチ適用後の技術分析。Axisデバイスに対するブラックボックステストを通じて独自に再発見・検証されたものです。...

CVE-2025-34030-PoC

CVE-2025-34030 - sar2html 'plot' パラメータ RCE CVSS: 10.0 緊急 脆弱性: OSコマンドインジェクション プログラミング言語: PHP エクスプロイトコード: Python 参照: https://nvd.nist.gov/vuln/detail/CVE-2025-34030 https://www.vulncheck.com/advisories/sar2html-command-injection 説明 sar2html バージョン 3.2.1 以下には、index.php の plot パラメータ（index.php?plot=;...

poc-rebar3

Rebar3 シェルインジェクション CVE-2020-13802 概念実証 root@kitploit: git clone https://github.com/vulnbe/poc-rebar3.git cd poc-rebar3 rebar3 clean クレジット Alexey Pronin @vulnbe 参考文献 Rebar3 の脆弱性分析 脆弱性是正 PR CVE-2020-13802 CWE-78: OSコマンドで使用される特殊要素の不適切な無効化（'OSコマンドインジェクション'）...

CVE-2026-82412

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/toscan.lua and scripts/lua/rest/v2/exec/host/schedulevulnerabilityscan.lua accept the scanports parameter without an administrator gate and pass it...

AZL-103398 CVE-2026-82412 affecting package ntopng 5.2.1-6

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/toscan.lua and scripts/lua/rest/v2/exec/host/schedulevulnerabilityscan.lua accept the scanports parameter without an administrator gate and pass it...

UBUNTU-CVE-2026-82412

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/toscan.lua and scripts/lua/rest/v2/exec/host/schedulevulnerabilityscan.lua accept the scanports parameter without an administrator gate and pass it...

CVE-2026-82412 ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/toscan.lua and scripts/lua/rest/v2/exec/host/schedulevulnerabilityscan.lua accept the scanports parameter without an administrator gate and pass it...

CVE-2026-82412

ntopng , a web-based network traffic monitoring application, is affected by an OS command injection in its vulnerability-scan REST API prior to version 6.7.260717 . The endpoints add/host/to_scan.lua and exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administ...

CVE-2026-82412 ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/toscan.lua and scripts/lua/rest/v2/exec/host/schedulevulnerabilityscan.lua accept the scanports parameter without an administrator gate and pass it...

CVE-2026-52616

CVE-2026-52616 — mcp-nmap-server: OS command injection via runnmapscan The runnmapscan MCP tool builds its command by string interpolation of the target and additionalFlags parameters and runs it through childprocess.exec, i.e. /bin/sh -c. ⚠ Read this first — duplicate identifier This vulnerabili...

CVE-2024-10914

CVE-2024-10914 D-Link DNS-320、DNS-320LW、DNS-325、DNS-340L（20241028 までのバージョン）に脆弱性が見つかりました。これは critical と評価されています。この脆弱性の影響を受けるのは、ファイル /cgi-bin/accountmgr.cgi?cmd=cgiuseradd 内の関数 cgiuseradd です。引数 name を操作すると、OS...