PT-2026-47047

Name of the Vulnerable Software and Affected Versions Arista Edge Threat Management - Arista Next Generation Firewall NGFW affected versions not specified Description A command injection issue exists in the Captive Portal Custom Handler. An administrative account logged into the user interface ca...

D-Link DWR-M920 命令注入漏洞

DWR-M920 is a D-Link wireless router device used for cellular network access and wireless sharing. The D-Link DWR-M920 has a command injection vulnerability. This vulnerability arises due to the sub41C8E8 function in /boafrm/formSmsManage not performing secure filtering on the actionvalue...

PT-2026-46838

A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.70. Affected is the function sub 41C8E8 of the file /boafrm/formSmsManage. Performing a manipulation of the argument action value results in command injection. The attack is possible to be carried out remotely. The exploit is now public a...

HAX 操作系统命令注入漏洞

HAX is an open-source microsite developed by HAX The Web, managed using PHP as the backend. Versions of HAX prior to 26.0.0 contained a vulnerability related to operating system command injection. This vulnerability stemmed from an authenticated file overwrite vulnerability, which could allow...

D-Link DWR-M920 命令注入漏洞

The D-Link DWR-M920 is a router produced by D-Link Corporation. Versions of the D-Link DWR-M920 prior to 1.1.50 contained a command injection vulnerability. This vulnerability stemmed from improper handling of the ussdValue parameter in the sub41CF20 function found in the /boafrm/formUSSDSetup...

HCL Digital Experience 安全漏洞

HCL Digital Experience is a digital experience platform and content delivery solution provided by the Indian company HCL. There is a security vulnerability in HCL Digital Experience. This vulnerability stems from an OS command injection issue in the digital asset management API. It could allow...

PT-2026-47045

Name of the Vulnerable Software and Affected Versions Arista Edge Threat Management - Arista Next Generation Firewall NGFW version 17.4.0 Description An encrypted password command injection vulnerability exists in the Captive Portal application framework. Command injection is a flaw that allows a...

PT-2026-47020

Name of the Vulnerable Software and Affected Versions Termix versions prior to 2.3.2 Description Termix is a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. The 'POST /ssh/tunnel/connect' endpoint allows persistent OS command injection on the...

PT-2026-46906

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover...

Termix 操作系统命令注入漏洞

Termix is a server management platform developed by Karmaa’s individual developers. Versions of Termix prior to 2.3.2 contained an operating system command injection vulnerability. This vulnerability stemmed from the GET /ssh/filemanager/ssh/resolvePath endpoint using double quotes to escape shel...

Markdown Preview Enhanced 操作系统命令注入漏洞

Markdown Preview Enhanced is a highly powerful markup extension developed by Yiyi Wang. Versions of Markdown Preview Enhanced prior to 0.8.28 contained a vulnerability related to operating system command injection. This vulnerability stemmed from opening external files and links via the shell...

Arista Edge Threat Management - Arista Next Generation Firewall 安全漏洞

Arista Edge Threat Management – Arista Next Generation Firewall is a unified network security platform developed by the American company Arista. It integrates next-generation firewalls, intrusion prevention, web filtering, application control, and network threat protection capabilities. Version...

PT-2026-46978

A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub 41CF20 of the file /boafrm/formUSSDSetup. The manipulation of the argument ussdValue results in command injection. It is possible to launch the attack remotely. The exploit is now public and may...

VulnCheck KEV: CVE-2026-20245

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplyi...

Teltonika RUTOS 安全漏洞

Teltonika RUTOS is a unified operating system based on OpenWrt by the Teltonika company. Vulnerabilities exist in versions 7.22 to 7.23.2 of Teltonika RUTOS, as well as in versions 1.09 to 1.09.1 of TSWOS. These vulnerabilities stem from unsafe calls to the eval function in rpc-profile, which may...

HAX 操作系统命令注入漏洞

HAX is an open-source microsite managed using HAX+CMS with a PHP backend. Versions of HAX prior to 26.0.0 had a vulnerability related to operating system command injection. This vulnerability stemmed from improper cleanup of input values when constructing shell command strings in the Git.php...

D-Link DWR-M920 操作系统命令注入漏洞

The D-Link DWR-M920 is a wireless router that provides network connectivity and configuration management functions. The D-Link DWR-M920 has a command injection vulnerability. This vulnerability stems from the sub412DA0 function in the file/boafrm/formIMEISetup failing to properly validate the...

Arista Edge Threat Management - Arista Next Generation Firewall 安全漏洞

Arista Edge Threat Management – Arista Next Generation Firewall is a unified network security platform developed by the American company Arista. It integrates next-generation firewalls, intrusion prevention, web filtering, application control, and network threat protection capabilities. There are...

PT-2026-46930

In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user...

PT-2026-47017

Name of the Vulnerable Software and Affected Versions Termix versions prior to 2.3.2 Description Termix is a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. An OS command injection exists in the "/ssh/file manager/ssh/resolvePath" endpoint. T...