PT-2026-59584

Summary The execute command function in shell tools.py calls os.path.expandvars on every command argument at line 64, manually re-implementing shell-level environment variable expansion despite using shell=False line 88 for security. This allows exfiltration of secrets stored in environment...

EUVD-2020-26796

Malware in sbrugna...

EUVD-2020-14351

Malware in sbrugna...

EUVD-2019-3814

Malware in sbrugna...

EUVD-2002-0176

Malware in sbrugna...

EUVD-2024-45920

Malicious code in bioql PyPI...

EUVD-2024-19396

Malicious code in bioql PyPI...

EUVD-2023-42702

Malicious code in bioql PyPI...

EUVD-2023-35523

Malicious code in bioql PyPI...

CVE-2025-54795 Claude Code echo command allowed bypass of user approval prompt for command execution

Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code...

CVE-2025-26074

Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes...

CVE-2025-52903

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions on the 2.x branch prior to 2.33.10, the Command Execution feature of File Browser only allows the execution of shell command which have be...

CVE-2019-20216

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because REMOTEPORT is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an...

D-Link DIR-832x 0x41dda8 Function Code Injection Vulnerability

The D-Link DIR-832x is a wireless router from China's AUO D-Link. A code injection vulnerability exists in the D-Link DIR-832x, which stems from the function 0x41dda8 failing to properly filter construct command special characters, commands, etc. An attacker can exploit this vulnerability to...

Dell ThinOS Command Injection Vulnerability

Dell ThinOS is a client operating system from the American company Dell. Dell ThinOS suffers from a command injection vulnerability that arises from an application's failure to properly filter constructed command special characters, commands, etc. The vulnerability can be exploited to execute...

CVE-2024-54018

Multiple improper neutralization of special elements used in an OS Command vulnerabilities CWE-78 in FortiSandbox before 4.4.5 allows a privileged attacker to execute unauthorized commands via crafted requests...

PT-2023-26841 · Tp Link · Archer C5 +1

Name of the Vulnerable Software and Affected Versions: Archer C5 versions all Archer C7 versions prior to Archer C7JP V2 230602 Description: The issue allows a network-adjacent authenticated attacker to execute arbitrary OS commands. Note that Archer C5 is no longer supported, and therefore, the...

CVE-2022-33189

An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to trigger this vulnerability...

PT-2022-6076 · Fortinet · Fortitester

Name of the Vulnerable Software and Affected Versions: FortiTester versions 2.3.0 through 3.9.1 FortiTester versions 4.0.0 through 4.2.0 FortiTester versions 7.0.0 through 7.1.0 Description: The issue exists due to the failure to neutralize special elements used in an OS command, allowing an...

CVE-2022-37881

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to comple...