188129 matches found
EUVD-2026-94452
A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...
CVE-2026-20321
A vulnerability exists in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) . Due to insufficient input validation of user-controlled command arguments, an authenticated remote attacker with valid administrative credentials can send crafted input to the AP...
EUVD-2026-94524
A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...
CVE-2026-20321 Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability
A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...
Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability
A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...
K000163588: Vim vulnerability CVE-2026-41411
Security Advisory Description Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variable...
CVE-2026-107202
A command injection vulnerability exists in the h-ui version v0.0.25 and below administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule...
CVE-2026-106556
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an...
CVE-2025-70521
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...
CVE-2025-70518
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...
CVE-2026-106510
The Backstage open framework for developer portals is vulnerable to remote code execution in versions prior to 1.14.6 . The flaw exists in the @backstage/plugin-techdocs-node package, where an authenticated user capable of registering catalog entities can provide a crafted mkdocs.yml file. This i...
CVE-2026-106510 Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdownextensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted...
CVE-2026-107202 CVE-2026-107202
A command injection vulnerability exists in the h-ui version v0.0.25 and below administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule...
CVE-2026-107202
The h-ui administrative API (version v0.0.25 and below ) is vulnerable to a command injection flaw due to improper validation of the listen configuration field . An authenticated administrator can submit values containing shell metacharacters, which the application then processes using fmt.Sprint...
CVE-2026-107202 CVE-2026-107202
A command injection vulnerability exists in the h-ui version v0.0.25 and below administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule...
CVE-2026-107202 CVE-2026-107202
A command injection vulnerability exists in the h-ui version v0.0.25 and below administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule...
EUVD-2026-94361
A command injection vulnerability exists in the h-ui version v0.0.25 and below administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule...
Exploit for OS Command Injection in Ivanti Standalone_Sentry
CVE-2026-10520-...
ChamiloLMS-CVE-2023-4220
ChamiloLMS CVE-2023-4220 Exploit Python exploit for CVE-2023-4220 , an unauthenticated arbitrary file upload vulnerability affecting Chamilo LMS = 1.11.24. The vulnerability is located in Chamilo's BigUpload component. On vulnerable installations, the upload handler allows a PHP file to be upload...
cups: cups: argument injection in mailto notifier via notify-recipient-uri
An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot b...