CVE-2026-118905

Node Version Manager (nvm ) versions 0.31.2 through 0.40.5 are vulnerable to command injection via the nvm_ls function. The root cause is that the sed program used to filter versions does not escape backslashes, allowing a version string containing # (or liga) to close a sed address early and exe...

smb_usermap

smbusermap A simple exploit for CVE-2007-2447, present in Samba 3.0.20. You can exploit this vuln with even less than this, for instance, with smbclient, but I think it's tough to do complex commands, since a lot of special chars probably get eaten, but a simple command reboot in this case can be...

CVE-2026-66088

In openEQUELLA before 2026.1, the system.execute function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of t...

CVE-2026-66088

In openEQUELLA before 2026.1, the system.execute function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of t...

EUVD-2026-112564

In openEQUELLA before 2026.1, the system.execute function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of t...

CVE-2007-2447

CVE-2007-2447 Samba 3.0.0 - 3.0.25rc3 are subject for Remote Command Injection Vulnerability CVE-2007-2447, allows remote attackers to execute arbitrary commands by specifying a username containing shell meta characters...

PT-2026-130610

Name of the Vulnerable Software and Affected Versions openEQUELLA versions prior to 2026.1 Description The scripting engine contains a flaw where the system.execute function runs operating system commands without validation or an allow-list of permitted executables. A user with permissions to...

PT-2026-132336

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.7 Progress Software WS FTP Server versions prior to 2025.0.4 Description An OS command injection issue exists in the Windows version of the software. This flaw allows for arbitrary comma...

PT-2026-132331

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.7 Progress Software WS FTP Server versions prior to 2025.0.4 Description Missing authorization in the administrative interface on Windows allows a delegated Host Administrator to exceed...

CVE-2026-90868: Progress Software WS_FTP Server: An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on…

An OS command injection vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations...

CVE-2026-90863: Progress Software WS_FTP Server: Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and…

Missing authorization in the administrative interface of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and...

CVE-2026-61564

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...

CVE-2026-61564

The AVideo video-sharing platform is vulnerable to PHP code injection and SQL injection in the unauthenticated installer endpoint install/checkConfiguration.php prior to version 8.1.0 . The root cause is the lack of escaping when interpolating request parameters, such as webSiteRootURL, into sing...

CVE-2026-61564 AVideo-Encoder: unauthenticated installer PHP code injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...

CVE-2021-29003

CVE-2021-29003 https://hackerworld.home.blog/2021/03/19/rce-in-genexis-router/ Exploit db https://www.exploit-db.com/exploits/49764 medium https://sharmajijvs.medium.com/how-i-got-my-first-cve-af2c3009e409 Unit 42 palo alto networks...

CVE-2026-78674 Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the...

CVE-2026-78674

Multiple WSO2 products are vulnerable to Remote Code Execution (RCE) due to insufficient input validation within the BPMN System REST APIs . An authenticated user can submit crafted requests to execute arbitrary commands on the server with the privileges of the product's runtime account. The pote...

CVE-2025-26264

CVE-2025-26264 CVE-2025-26264 - GeoVision GV-ASWeb with the version 6.1.2.0 or less, contains a Remote Code Execution RCE vulnerability within its Notification Settings feature. An authenticated attacker with "System Settings" privileges in ASWeb can exploit this flaw to execute arbitrary command...

CVE-2026-106079

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YAN...

CVE-2026-103403

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of...