CVE-2025-27759

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiWeb version 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10 and before 7.0.10 allows an authenticated privileged attacker to execute unauthorized code o...

PT-2025-32690 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.8 Description: WeGIA is an open-source web manager designed for the Portuguese language and charitable institutions. A SQL Injection vulnerability exists in the /html/funcionario/dependente remover.php API endpoint...

Linux Distros Unpatched Vulnerability : CVE-2020-1734

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen with shell=True, by...

Security Updates for Microsoft Office Online Server (August 2025)

The Microsoft Office Online Server installation on the remote host is missing security updates. It is, therefore, affected by multiple remote code execution vulnerabilities. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. %NASLMINLEVEL 80900 C...

Security Updates for Microsoft PowerPoint Products (August 2025)

The Microsoft PowerPoint Products are missing a security update. They are, therefore, affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for this issue but has instea...

Dell Unity OS Command Injection Vulnerability

Dell Unity is a mid-range hybrid flash storage platform from Dell that supports a wide range of workloads, including files and data blocks, and offers flexible deployment options and modern management capabilities. Dell Unity suffers from an operating system command injection vulnerability that c...

CVE-2025-8748

MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious HTTP request crafted by an authenticated user could allow the execution of arbitrary commands on the underlying operating system...

CVE-2012-10048 Zenoss 3.x showDaemonXMLConfig Command Execution

Zenoss Core 3.x contains a command injection vulnerability in the showDaemonXMLConfig endpoint. The daemon parameter is passed directly to a Popen call in ZenossInfo.py without proper sanitation, allowing authenticated users to execute arbitrary commands on the server as the zenoss user...

CVE-2012-10048 Zenoss 3.x showDaemonXMLConfig Command Execution

Zenoss Core 3.x contains a command injection vulnerability in the showDaemonXMLConfig endpoint. The daemon parameter is passed directly to a Popen call in ZenossInfo.py without proper sanitation, allowing authenticated users to execute arbitrary commands on the server as the zenoss user...

CVE-2025-54958

Powered BLUE 870 versions 0.20130927 and prior contain an OS command injection vulnerability. If this vulnerability is exploited, arbitrary OS commands may be executed on the affected product...

CVE-2025-54958

Powered BLUE 870 versions 0.20130927 and prior contain an OS command injection vulnerability. If this vulnerability is exploited, arbitrary OS commands may be executed on the affected product...

CVE-2025-54958

Powered BLUE 870 by Mubit co.,ltd. contains an OS command injection vulnerability (CWE-78) in versions 0.20130927 and earlier. An authenticated user could execute arbitrary OS commands on the affected product. {Root cause: improper handling of input leading to command injection per CVE-2025-54958...

Huawei EnzoH 安全漏洞

Huawei EnzoH is a wireless access device from Huawei China. Huawei EnzoH suffers from an operating system command injection vulnerability that can be exploited by an attacker to cause arbitrary command execution...

The vulnerability of the web interface of the microprogrammed software routers DIR-615 allows a hacker to execute arbitrary commands.

The vulnerability of the web interface of the microprogrammed software router DIR-615 arises from the lack of checks on input data in the pingipaddr parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-34149

A command injection vulnerability affects the Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02 during WPA2 configuration. The 'key' parameter is interpreted directly by the system shell, enabling attackers to execute arbitrary commands as root. Exploitation requires no authentication and c...

CVE-2025-34149 Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via WPA2 Key

A command injection vulnerability affects the Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02 during WPA2 configuration. The 'key' parameter is interpreted directly by the system shell, enabling attackers to execute arbitrary commands as root. Exploitation requires no authentication and c...

CVE-2025-50688

A command injection vulnerability exists in TwistedWeb version 14.0.0 due to improper input sanitization in the file upload functionality. An attacker can exploit this vulnerability by sending a specially crafted HTTP PUT request to upload a malicious file e.g., a reverse shell script. Once...

PT-2025-32274 · Aitemi · Aitemi M300 Wi-Fi Repeater

Name of the Vulnerable Software and Affected Versions: Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02 affected versions not specified Description: A command injection vulnerability exists during WPA2 configuration. The key parameter is directly interpreted by the system shell, allowing...

Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

...

SUSE CVE-2025-52903

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions on the 2.x branch prior to 2.33.10, the Command Execution feature of File Browser only allows the execution of shell command which have be...