Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the processFile function in the wxapkg File Parser component. An attacker can execute arbitrary system commands by providing crafted input to this function. Remediation There is no fixed version for...

CVE-1999-0255

Buffer overflow in ircd allows arbitrary command execution...

CVE-1999-0146

The campas CGI program provided with some NCSA web servers allows an attacker to execute arbitrary commands via encoded carriage return characters in the query string, as demonstrated by reading the password file...

CVE-1999-0766

The Microsoft Java Virtual Machine allows a malicious Java applet to execute arbitrary commands outside of the sandbox environment...

CVE-1999-0551

HP OpenMail can be misconfigured to allow users to run arbitrary commands using malicious print requests...

CVE-2025-4008

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote...

CVE-2025-27804

Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions...

CVE-2025-48415

The eCharge Hardy Barth cPH2 and cPP2 electric vehicle charging stations (version 2.2.0 ) are affected by a USB backdoor feature. An attacker can trigger this backdoor by attaching a USB drive containing specially crafted salia.ini files. These files can contain commands that allow the attacker t...

CVE-2025-48415: Exposed Dangerous Method or Function

A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contain several "commands" that could be exploited by an attacker to export or modify the device configuration, enable an SSH backdoor or perform other...

CVE-2025-4008: Improper Neutralization of Special Elements used in a Command

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote...

PT-2025-22344

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description A USB backdoor feature can be triggered by attaching a USB drive containing specially crafted salia.ini files. These files can contain commands that an attacker could exploit to export or modi...

VMware vCenter Server Command Injection

The vulnerability of the software for managing VMware vCenter Server lies in the lack of measures taken to neutralize the special elements used in the operating system’s command set. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

TOTOLINK A3002R Command Injection Vulnerability

TOTOLINK A3002R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3002R suffers from a command injection vulnerability that stems from the FUN00459fdc function failing to properly filter constructed command special characters, commands, etc. The vulnerability can be...

CVE-2025-44881

The Wavlink WL-WN579A3 v1.0 wireless card is susceptible to a command injection vulnerability within the /cgi-bin/qos.cgi component. The root cause is unfiltered input , which allows an attacker to execute arbitrary commands via a crafted request. Exploitation of this flaw could lead to a total t...

CVE-2025-44882

A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input...

CVE-2025-44882

The Wavlink WL-WN579A3 v1.0 router is affected by a command injection vulnerability in the /cgi-bin/firewall.cgi component. The root cause is the failure to neutralize specific elements used in operating system commands, allowing an attacker to submit a special request with unfiltered input to ex...

CVE-2025-44880

A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input...

CVE-2025-44881

A command injection vulnerability in the component /cgi-bin/qos.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input...

CVE-2025-44880

The Wavlink WL-WN579A3 v1.0 dual-band wireless card is affected by a command injection vulnerability in the /cgi-bin/adm.cgi component. The root cause is the improper neutralization of special elements used in operating system commands, which allows a remote attacker to submit a crafted request a...

CVE-2025-44880: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input...