8693 matches found
CVE-2025-69212-PoC
CVE-2025-69212 - PoC de Inyección de Comandos del SO en OpenSTAManager Uso Instala las dependencias: root@kitploit: pip install -r requirements.txt Ejecuta un comando único y muestra su salida: root@kitploit: python3 cve-2025-69212poc.py -u http://target.com -U admin -P 'password' -c 'id' En su...
CVE-2026-83548-checker
SonicWall SMA 1000 — Détecteur d'exposition CVE-2026-83548 / CVE-2026-83549 Un script de détection non intrusif pour les appliances SonicWall Secure Mobile Access SMA 1000 affectées par CVE-2026-83548 SSRF pré-authentification dans l'interface Work Place, CVSS 10.0 et CVE-2026-83549 injection de...
CVE-2026-53932
wnx/laravel-backup-restore (vulnerable prior to 1.9.4 ) is subject to OS command injection during database restore. The restore workflow extracts a ZIP archive, enumerates files under db-dumps, and interpolates the dump filename into shell command strings (e.g., mysql ...
CVE-2026-53932 wnx/laravel-backup-restore: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') and Improper Neutralization of Special Elements used in a Command ('Command Injection')
laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4...
CVE-2026-78327
An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the...
CVE-2026-78327
An OS Command Injection (CWE-78) in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands executed on the underlying host, resulting in remote code execution . The vulnerability affects NS...
EUVD-2026-71679
An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the...
CVE-2026-78327
An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the...
EUVD-2026-71619
An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters...
CVE-2026-85656
CVE-2026-85656 is an OS command injection vulnerability in the log4j-cve-2021-44228-hotpatch package in Amazon Linux versions before 1.3-9 . A local user with low privileges can execute arbitrary commands with root privileges by leveraging embedded newline characters in a Java process's executabl...
CVE-2026-16826
CVE-2026-16826 affects the Debug Server component of IBM i versions 7.3 through 7.6. The root cause is OS command injection (CWE-78), where special elements in an OS command are not properly neutralized, allowing a local attacker with low privileges to execute arbitrary commands. The CVSS v3.1 sc...
CVE-2026-85696
SadTalker (OpenTalker), a talking-head video generation tool, contains an OS command injection vulnerability in its video muxing process . In version v0.0.2 , uploaded audio filenames are interpolated into ffmpeg commands without proper escaping (see src/utils/videoio.py). An attacker can upload ...
CVE-2026-85696 SadTalker OS Command Injection via Audio Filename
SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...
CVE-2026-85672
zerox 1.1.20 (getomni-ai) is affected by an OS command injection in its file download mechanism. The temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. An attacker can craft a document URL with a malicious file extens...
EUVD-2026-71128
zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...
ip-camera-research
IP Camera Research - Fullhan FH8626V100 AJL30PG0803 Security research on a consumer IP camera built on the Fullhan FH8626V100 SoC model AJL30PG0803, resulting in six assigned CVEs covering unauthenticated API access, plaintext credential disclosure, and full unauthenticated device compromise via ...
CVE-2026-22226
CVE-2026-22226 Proof of Concept for CVE-2026-22226 Authenticated LAN-side OS Command Injection in the VPN Client of TP-Link Archer Wi-Fi routers Vulnerability brief The VPN Client controller stores the user-controlled entry description des in the UCI configuration with a weak validation regex. Wh...
CVE-2026-62928
XING CPTrans-ME-X contains an OS Command Injection CWE-78. Unauthenticated OS command may be injected...