CVE-2026-34498

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

CVE-2026-105841

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

CVE-2026-105788

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command...

CVE-2026-105793 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the presskey tool in ufo/client/mcp/httpservers/mobilemcpserver.py accepts a free-form keycode parameter and passes it to adb shell input keyevent. The adb client joins the arguments...

CVE-2026-105793

The Microsoft UFO open-source framework is vulnerable to an authenticated Android shell command injection in the press_key tool within ufo/client/mcp/http_servers/mobile_mcp_server.py prior to version 3.0.9 . The root cause is the handling of a free-form key_code parameter, which is passed to adb...

CVE-2026-105793 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the presskey tool in ufo/client/mcp/httpservers/mobilemcpserver.py accepts a free-form keycode parameter and passes it to adb shell input keyevent. The adb client joins the arguments...

EUVD-2026-93421

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the presskey tool in ufo/client/mcp/httpservers/mobilemcpserver.py accepts a free-form keycode parameter and passes it to adb shell input keyevent. The adb client joins the arguments...

mcpshield

mcpshield 一个针对未修补的 MCP STDIO 命令注入漏洞（CVE-2026-30623 系列，由 OX Security 于 2026 年 4 月披露，归为“设计问题”——无 SDK 补丁）的即插即用修复方案。只需导入一行代码，你的 Python 应用启动的每个 stdio MCP 服务器，在操作系统生成进程之前，其命令/参数/环境变量都会经过验证。 如果你是新手，请先阅读 适用范围，然后 安装 和 快速入门 将让你在两分钟内获得保护。 目录 项目状态 适用范围 安装 快速入门 选项 A：自动补丁（Python MCP 主机） 选项 B：静态检查（任何语言，零执行） 选项...

CVE-2020-24572-POC

CVE-2020-24572-POC Se descubrió un problema en includes/webconsole.php en RaspAP 2.5. Con acceso autenticado, un atacante puede usar una consola web mal configurada y prácticamente sin restricciones para atacar el sistema operativo subyacente que ejecuta este software, y ejecutar comandos en el...

cve-2017-12945

CVE-2017-12945 Exploit for CVE-2017-12945 A remote authenticated blind OS command injection vulnerability exists in Mersive Solstice Pods - a wireless collaboration and presentation platform designed by Mersive Technologies Inc. - running versions of the firmware prior to 2.8.4, as...

CVE-2026-105788

The Microsoft UFO open-source framework is vulnerable to authenticated Android shell command injection in versions prior to 3.0.10 . The flaw exists in the type_text and launch_app tools within ufo/client/mcp/http_servers/mobile_mcp_server.py, where the text and package_name parameters are passed...

EUVD-2026-93405

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command...

CVE-2026-105788 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command...

CVE-2024-53376

CVE-2024-53376 CyberPanel Authenticated OS Command Injection Affected Devices CyberPanel versions 2.3.8 are vulnerable to an OS command injection. To exploit the vulnerability the attacker is required to firstly login to the webpanel. Tested With CyberPanel 2.3.7 Technical details An attacker can...

CVE-2020-15778-SCP-Command-Injection-Check

CVE-2020-15778 – OpenSSH SCP 命令注入漏洞（检测脚本） 关于 CVE-2020-15778 是 OpenSSH（版本 ≤ 8.3p1）提供的 scp 工具中发现的一个命令注入漏洞。该问题允许攻击者在客户端系统上执行任意命令，前提是向 scp 传递了包含反引号的构造目标参数。 此仓库包含一个用 Bash 编写的安全检测与模拟脚本 。该脚本可帮助用户和系统管理员： 识别其系统的 scp 版本是否存在漏洞 了解漏洞的工作原理 测试并检测危险的命令输入（例如包含反引号的参数） 学习如何缓解和避免该漏洞 什么是 CVE-2020-15778？ 在 OpenSSH scp...

CVE-2019-1653

CVE-2019-1653 Cisco Small Business RV320和RV325双千兆WAN VPN路由器的基于Web的管理接口中存在一个漏洞，可能允许未经身份验证的远程攻击者检索敏感信息。 这个简单的Python脚本是针对CVE-2019-1653的自动化利用工具，可感染Cisco Small Business RV320和RV325设备。所利用的第一个漏洞是敏感信息泄露（SIE），未经身份验证的攻击者可以窃取凭证以进入路由器仪表盘，并在生成证书页面上执行命令注入，从而开放telnet端口，使攻击者能够对易受攻击的设备进行进一步的入侵。...

EUVD-2026-93399

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1...

CVE-2026-85523 OS Command Injection in Felisify Informatics' SambaBox

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1...

CVE-2026-85523

SambaBox by Felisify Information Technologies Industry and Trade Inc. is vulnerable to OS Command Injection due to the improper neutralization of special elements used in an OS command (CWE-78 ). This issue affects versions before 5.4.1 . An attacker could potentially execute arbitrary commands o...

pfBlockerNg-CVE-2022-40624

pfBlockerNg-CVE-2022-40624 Antecedentes pfBlockerNG es la próxima generación de pfBlocker con las siguientes características: 1. Administrar fuentes de listas IPv4/v6 en formatos 'Denegar, Permitir o Coincidir'. 2. Base de datos GeoIP de MaxMind Inc. versión gratuita GeoLite2. 3. Mejoras de...