11795 matches found
CVE-2025-58383
A vulnerability in Brocade Fabric OS versions before 9.2.1c2 could allow an administrator-level user to execute the bind command, to escalate privileges and bypass security controls allowing the execution of arbitrary commands...
CVE-2026-25157: Improper Neutralization of Special Elements used in an OS Command
OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. The sshNodeCommand function constructed a shell script without properly escaping the user-supplied project path in an error message. When th...
CVE-2026-20098: Unrestricted Upload of File with Dangerous Type
A vulnerability in the Certificate Management feature of Cisco Meeting Management could allow an authenticated, remote attacker to upload arbitrary files, execute arbitrary commands, and elevate privileges to root on an affected system. This vulnerability is due to improper input validation in...
CVE-2026-20980: Undefined Security Weakness
Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands...
CVE-2025-13375: Execution with Unnecessary Privileges
IBM Common Cryptographic Architecture CCA 7.5.52 and 8.4.82 could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system...
CVE-2025-59818: Improper Neutralization of Special Elements used in a Command
This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file...
CVE-2026-20981: Undefined Security Weakness
Improper input validation in FacAtFunction prior to SMR Feb-2026 Release 1 allows privileged physical attacker to execute arbitrary command with system privilege...
Zenitel TCIS-3+ security vulnerabilities
Zenitel TCIS-3+ is an IP intercom terminal produced by the Norwegian company Zenitel. There is a security vulnerability in Zenitel TCIS-3+, which allows authenticated attackers to execute arbitrary commands on the underlying system using the file names uploaded by them...
CVE-2026-25143: Improper Neutralization of Special Elements used in an OS Command
melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds...
Exploit for CVE-2025-65791
CVE-2025-65791 — Command Injection in ZoneMinder Overview...
CVE-2025-58383 Privilege escalation via bind command in Brocade Fabric OS
A vulnerability in Brocade Fabric OS versions before 9.2.1c2 could allow an administrator-level user to execute the bind command, to escalate privileges and bypass security controls allowing the execution of arbitrary commands...
Broadcom Brocade Fabric OS security vulnerabilities
Broadcom Brocade Fabric OS FOS is an embedded operating system used in switches and routers by Broadcom Corporation. Versions of Broadcom Brocade Fabric OS prior to 9.2.1c2 contained security vulnerabilities. These vulnerabilities stemmed from the possibility for administrator-level users to...
EUVD-2025-206613
The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged authenticated attacker may be able to execute arbitra...
CVE-2026-24788
RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...
EUVD-2026-5116
RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...
boaform formSysCmd Command Execution
The vulnerability of the system function /boaform/formSysCmd in the microprogramming software for Tenda HG10 optical network terminals is related to the lack of measures taken to neutralize special elements during the processing of the sysCmd parameter. Exploiting this vulnerability allows a remo...
Delta Electronics DIAView Command Injection Vulnerability
Delta Electronics DIAView is an industrial configuration software from Delta Electronics, mainly used in SCADA systems. A command injection vulnerability exists in Delta Electronics DIAView, which can be exploited by an attacker to execute arbitrary commands on the system...
CVE-2025-9974: Improper Neutralization of Special Elements used in an OS Command
The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged authenticated attacker may be able to execute arbitra...
