188430 matches found
CVE-2026-104085: Improper Neutralization of Special Elements used in an OS Command
odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $id i...
PT-2026-113545
Name of the Vulnerable Software and Affected Versions Citrix UniconOS versions prior to 2607.2 CR Citrix UniconOS versions prior to 2603 LTSR CU2 Description An issue in Citrix UniconOS allows for persistent command execution. Recommendations Update Citrix UniconOS to version 2607.2 CR or later...
PT-2026-113153
Name of the Vulnerable Software and Affected Versions Microsoft Windows Shell versions prior to October 13, 2026 Windows 10 affected versions not specified Windows 11 versions 23H2 through 26H2 Windows Server versions 2012 R2 through 2025 Description Improper neutralization of special elements us...
CVE-2026-104585
Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...
PT-2026-111311
Name of the Vulnerable Software and Affected Versions Wavlink WL-WN592AX6 version 250422 Description A flaw in the wmapd Daemon allows for remote OS command injection. The issue resides within the system function, enabling an attacker to execute arbitrary operating system commands without...
PT-2026-111395
Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V6.0 Description Authenticated attackers with specific privileges can execute arbitrary SQL commands on the underlying database. This occurs because the system fails to properly validate or sanitize the...
PT-2026-112874
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...
PT-2026-111781
Name of the Vulnerable Software and Affected Versions Fortinet FortiManager version 8.0.0 Fortinet FortiManager versions 7.6.0 through 7.6.6 Fortinet FortiManager Cloud versions 7.6.2 through 7.6.6 Description An OS command injection issue exists due to improper neutralization of special elements...
PT-2026-111393
Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V6.0 Description Authenticated attackers with specific privileges can execute arbitrary SQL commands on the underlying database. This occurs because the system fails to properly validate or sanitize input...
PT-2026-111604
Name of the Vulnerable Software and Affected Versions CVFS affected versions not specified Description An input validation issue exists that allows for command execution. Recommendations Update CVFS to the resolved maintenance release...
PT-2026-113218
Name of the Vulnerable Software and Affected Versions Microsoft Office OneNote affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to execute code over a network. Recommendations At...
PT-2026-111181
Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.2.7 GitLab EE versions 19.3 through 19.3.4 GitLab EE versions 19.4 through 19.4.1 Description An issue exists where improper neutralization of special elements during the construction of AI conversation conte...
CVE-2026-104585
Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection within the /download_data/ and /api/v1/scan endpoints. The flaw specifically affects the Dynamic Analyzer ADB integration module . This vulnerability allows for the execution of arbitrary commands on the underlying system...
PT-2026-112041
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check filter exec in mt.c passed the constructed command...
PT-2026-111830
Name of the Vulnerable Software and Affected Versions Roo Code versions prior to 3.54.1 Description A command approval bypass exists in the parseCommandLine function. This issue allows attackers to auto-approve arbitrary shell commands by placing a command substitution in the command position. By...
PT-2026-111680
Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 4.10.17-lts Description Ansible-based automation rendering allows the evaluation of attacker-controlled template expressions by users with permissions to create or execute affected automation tasks. This can trigge...
PT-2026-111824
Name of the Vulnerable Software and Affected Versions Mistral Vibe versions prior to 2.25.4 Description A command permission gate bypass allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value. This technique evades detection by...
PT-2026-111302
Name of the Vulnerable Software and Affected Versions Wavlink WL-WN530BE1-A version 251117 Description A remote OS command injection exists in the /cgi-bin/uploadVpn.cgi endpoint. The issue occurs when the Type variable is manipulated, affecting the popen function. OS command injection is a flaw...
PT-2026-111728
Name of the Vulnerable Software and Affected Versions Cronicle versions prior to 0.9.119 Description An issue exists in the administrator Activity Log within htdocs/js/pages/admin/Activity.js where the item.user.full name value is concatenated into HTML without proper encoding via encode entities...
PT-2026-113310
Name of the Vulnerable Software and Affected Versions Komodo version 2.2.0 Description The periphery agent's container-management functionality allows an authenticated low-privileged user with Execute or Read and Logs permissions to perform OS command injection. By supplying shell metacharacters ...