CVE-2025-70521

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...

EUVD-2025-211046

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...

VulnCheck KEV: CVE-2026-29058

AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration e.g., configuration...

CVE-2025-70518

The Fanvil x7a device, running firmware version 2.6.0.1182 , contains a command injection vulnerability in the management portal's diagnostic ping tool . Due to insecure handling of user-supplied input, an unauthenticated attacker can inject commands to execute arbitrary code on the underlying An...

Linux Distros Unpatched Vulnerability : CVE-2026-105841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by...

PT-2026-107511

Update: Since the original post, 20 additional Langflow CVEs have been published, including several high- and critical-severity vulnerabilities affecting versions up to 1.12.2. The newly disclosed issues cover a range of impact areas, including remote code execution, command injection,...

CVE-2025-70521

The Fanvil x7a device, running firmware version 2.6.0.1182 , contains a critical vulnerability in the management portal's diagnostic ping tool . Due to improper neutralization of special elements, the tool fails to handle user-supplied input securely. This allows an unauthenticated attacker to pe...

CVE-2025-70518

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...

EUVD-2025-211049

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...

PT-2026-107484

GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do...

PT-2026-107478

Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges coul...

PT-2026-107481

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...

PT-2026-107482

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell quote nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to...

PT-2026-107483

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...

PT-2026-107525

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...

PT-2026-107528

Unpatched vulnerabilities don't stay hidden on our atlas. CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2025-70521 Vendor → Unknown Severity → Critical — CVSS 9.8 Product → Unknown Date → 2026-10-07 A critical vulnerability Command Injection has been disclosed affecting Unknown. Patch...

PT-2026-107538

A command injection vulnerability exists in the h-ui version v0.0.25 and below administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule...

CVE-2025-70521

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...

CVE-2026-106583

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...

CVE-2018-11510

Quelques exploits pour CVE-2018-11510 par Kyle Lovett @SquirrelBuddha et moi-même Matthew Fulton/@haqur. Tire parti d'une injection de commande non authentifiée pour obtenir un shell root. Le module metasploit contient une charge utile séparée incluse dans le dépôt. Je verrai si je peux les faire...