The vulnerability of the Shell command shell in Windows operating systems, which allows attackers to exploit their privileges

The vulnerability of the Shell command shell in Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain increased privileges...

Shopping Cart 安全漏洞

Shopping Cart is a SSH host connection management tool developed by Thijmen’s individual developer. Version 0.0.2 of Shopping Cart contains a security vulnerability, which stems from command injection in the connect function. This vulnerability could potentially allow for the execution of arbitra...

SUSE CVE-2026-4786

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open" API could have commands injected into the underlying shell. See CVE-2026-4519 for details...

Active Debug Code

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Active Debug Code via the git.json.php script, which executes a shell command and returns sensitive information as JSON to any unauthenticated user. An attacker ca...

CVE-2026-39620

Cross-Site Request Forgery CSRF vulnerability in priyanshumittal Appointment appointment allows Upload a Web Shell to a Web Server.This issue affects Appointment: from n/a through = 3.5.5...

CVE-2026-32892

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move function in fileManage.lib.php passes user-controlled path values directly into exec shell commands without using...

EUVD-2026-22589

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network...

EUVD-2026-22613

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

EUVD-2026-22536

Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network...

EUVD-2026-22462

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Shell allows an authorized attacker to elevate privileges locally...

EUVD-2026-22392

Use after free in Windows Shell allows an authorized attacker to elevate privileges locally...

EUVD-2026-22394

Double free in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-32225

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-32202

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-32151

Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network...

CVE-2026-27918

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-26166

Double free in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-26165

Use after free in Windows Shell allows an authorized attacker to elevate privileges locally...

composer: command injection via malicious Perforce repository definition

A flaw was found in Composer. Perforce::generateP4Command constructs shell commands by interpolating user-supplied Perforce connection parameters port, user, client without proper escaping, allowing an attacker to inject arbitrary commands through these values in a malicious composer.json declari...

composer: command injection via malicious Perforce source reference/url

A flaw was found in Composer. Perforce::syncCodeBase appends the $sourceReference parameter to a shell command without proper escaping, allowing an attacker to inject arbitrary commands through a crafted source reference containing shell metacharacters...