73108 matches found
EUVD-2026-52223
A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function setsysadm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly...
CVE-2026-18590
The CVE concerns Wavlink WL-NU516U1 (firmware MT7628) where the Admin Password Handler’s function set_sys_adm in adm.cgi is vulnerable to OS command injection. The underlying issue enables a remote attacker to trigger code execution, with the exploit publicly disclosed. Impact is remote, affectin...
CVE-2026-18590 Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection
A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function setsysadm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly...
CVE-2026-18587
CVE-2026-18587 affects Wavlink WL-NU516U1 (708c073-mt7628). The flaw is in an unknown function of Config Import where manipulating the Password argument can trigger an OS command injection. The issue is exploitable remotely with high impact to confidentiality, integrity, and availability (C/I/A: ...
EUVD-2026-52160
A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high...
CVE-2026-18587 Wavlink WL-NU516U1 Config Import os command injection
A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high...
D-Link - Unauthenticated Remote Code Execution
OS command injection vulnerability in soap.cgi soapcgimain in cgibin in D-Link DIR-880L DIR-880LREVAFIRMWAREPATCH1.08B04 and previous versions, DIR-868L DIR868LA1FW112b04 and previous versions, DIR-65L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and...
Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection
Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php. This in turn can lead to...
Hytec Inter HWL-2511-SS - Remote Command Execution
Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi. id: CVE-2022-36553 info: name: Hytec Inter HWL-2511-SS - Remote Command Execution author: HuTa0 severity: critical description: | Hytec Inter HWL-2511-SS...
Chamilo Command Injection
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11. up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name. id: CVE-2023-34960 info: name: Chamilo Command Injection author: DhiyaneshDK severity: critical...
Atlassian Bitbucket - Remote Command Injection
Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...
D-Link NAS - Command Injection via Group Parameter
A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgiuseradd of the file /cgi-bin/accountmgr.cgi?cmd=cgiuseradd. The manipulation of the argument group leads to os command injection. i...
PT-2026-67464
A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private key can lead to command injection. The attack m...
EUVD-2026-52481
The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...
CVE-2026-52102
CVE-2026-52102 is an OS command injection vulnerability in the OpenMediaVault OpenMediaVault-md plugin (v8.0.4-1). The flaw allows an attacker to inject shell metacharacters to run arbitrary commands as root. Concrete details: affected software/component is the openmediavault-md plugin for OpenMe...
📄 Telenia Software TVox 26.5.3 Command Injection
Telenia Software TVox versions 26.5.3 and below suffer from a command injection vulnerability in actionaudio.php. ------------------------------------------------------------------------------------- Telenia Software TVox = 26.5.3 actionaudio.php OS Command Injection Vulnerability...
CVE-2026-51190
The CVE-2026-51190 entry concerns Serverless-Devs (package @serverless-devs/s) version
PT-2026-67452
A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove package/plugins.install package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The...