Command Injection

Overview baserproject/baser-core is a baserCMS plugin for CakePHP Affected versions of this package are vulnerable to Command Injection through the update functionality in the update process. An authenticated attacker with administrator privileges can execute arbitrary OS commands on the server b...

PT-2026-29146

Name of the Vulnerable Software and Affected Versions baserCMS versions prior to 5.2.3 Description baserCMS contains an OS command injection flaw in its core update functionality. An authenticated administrator can execute arbitrary OS commands on the server because user-controlled input is passe...

EUVD-2026-17204

In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a...

PT-2026-29155

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.3 Description Glances, a system cross-platform monitoring tool, allows for the execution of arbitrary system commands through dynamic configuration values. Specifically, substrings enclosed in backticks within...

CVE-2026-4622

OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network...

CVE-2026-33280

Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS commands...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the software installer pipeline that generates uninstall shell scripts without sanitization. An attacker can execute arbitrary system commands with elevated privileges by crafting malicious software package metadat...

CVE-2021-27708

Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system...

EUVD-2026-16587

OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network...

CVE-2026-4622

CVE-2026-4622 affects NEC Platforms, Ltd. Aterm Series devices. Multiple connected sources (NVD, JVN, EUVD, Red Hat, CIRCL, CVE list, vuln enrichment, etc.) confirm an OS Command Injection vulnerability that allows an attacker to execute arbitrary OS commands over the network. The NVD entry lists...

CVE-2026-33280

Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS commands...

nanobot 安全漏洞

Nanobot is a lightweight personal AI assistant open-source by Data Intelligence Lab@HKU. Versions of Nanobot prior to 0.1.6 contained a security vulnerability. This vulnerability stemmed from an indirect prompt injection issue in the email channel processing module, which could allow remote...

CVE-2026-30304

AI Code’s CVE-2026-30304 stems from its design that auto-executes commands deemed safe while requiring approval for potentially destructive ones. Multiple trusted sources describe a prompt-injection flaw: an attacker can wrap malicious commands in a generic template and fool the model into classi...

BUFFALO Wi-Fi router 安全漏洞

The BUFFALO Wi-Fi router is a series of routers developed by the Japanese company BUFFALO. The BUFFALO Wi-Fi router has a security vulnerability, which stems from issues with hidden functions. This vulnerability could allow attackers to access the product’s debugging functions, enabling them to...

Wazuh 代码注入漏洞

Wazuh is an open-source application developed by Wazuh. It is used for collecting, summarizing, indexing, and analyzing security data, helping organizations detect intrusions, threats, and abnormal behaviors. There is a code injection vulnerability in versions 2.1.0 before 4.8.0 of Wazuh Agent an...

BUFFALO Wi-Fi router 操作系统命令注入漏洞

The BUFFALO Wi-Fi router is a series of routers developed by the Japanese company BUFFALO. The BUFFALO Wi-Fi router has a vulnerability related to operating system command injection. This vulnerability stems from the presence of OS command injection, which may lead to the execution of arbitrary O...

PT-2026-28475

Name of the Vulnerable Software and Affected Versions BUFFALO Wi-Fi router products affected versions not specified Description A hidden functionality issue exists that may allow an attacker to gain access to the product’s debugging functionality. Successful exploitation could result in the...

CVE-2026-26791

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enableechoserver function. This vulnerability allows attackers to execute arbitrary commands via a crafted input...

CVE-2017-20221

Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0 contains a cross-site request forgery vulnerability that allows authenticated attackers to execute arbitrary system commands by exploiting missing request validation. Attackers can craft malicious web pages that perform administrative actions when...

CVE-2026-31993

OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass...