CVE-2026-101001 Netcore NBR200V2 Web Management network_tools eval os command injection

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/networktools of the component Web Management Interface. Such manipulation of the argument QUERYSTRING leads to os command injection. It is possible to launch the attack...

EUVD-2026-88083

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/networktools of the component Web Management Interface. Such manipulation of the argument QUERYSTRING leads to os command injection. It is possible to launch the attack...

CVE-2026-100896

A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the component Web Management Interface. This manipulation of the argument wlanif causes os command injection. Remote exploitation of the attack is...

Jenkins - Remote Command Injection

Jenkins 2.153 and earlier and LTS 2.138.3 and earlier are susceptible to a remote command injection via stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this wa...

CVE-2026-100896 TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection

A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the component Web Management Interface. This manipulation of the argument wlanif causes os command injection. Remote exploitation of the attack is...

EUVD-2026-88060

A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the component Web Management Interface. This manipulation of the argument wlanif causes os command injection. Remote exploitation of the attack is...

CVE-2026-100896

The TOTOLINK N150RT (version 3.4.0-B20201030) is vulnerable to OS command injection via its Web Management Interface . The root cause is the improper handling of the wlanif argument within the "function system" of the /boafrm/formWlSiteSurvey file. This flaw allows for remote exploitation , and p...

CVE-2026-100896 TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection

A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the component Web Management Interface. This manipulation of the argument wlanif causes os command injection. Remote exploitation of the attack is...

PT-2026-102399

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description A command injection issue exists that allows remote attackers to execute arbitrary commands. The flaw is located in the /api/ZRQos/set online client endpoint, where improper handling of the ip...

PT-2026-99783

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description A command injection issue exists in the File Merge Handler component within the merge split file function located in the /www/server/panel/class/files.py file. A remote attacker can exploit th...

PT-2026-102391

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description A remote command injection issue exists in the /api/ZRnetwork/firstLogin endpoint. This occurs when the firstLogin argument is manipulated, allowing an attacker to execute arbitrary commands on th...

PT-2026-99848

Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central versions prior to 6201 Description Command injection is possible in the Windows DNS Query Resolution Policy name field, which can lead to remote code execution. Command injection is a flaw that allows an attacker to...

PT-2026-99942

Name of the Vulnerable Software and Affected Versions WatchGuard AP affected versions not specified Description An OS command injection flaw exists in the internal API service. This issue allows an attacker with network access to the access point to execute arbitrary shell commands on the...

PT-2026-99784

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description An OS command injection flaw exists in the Unzip Handler component. A remote attacker can exploit this by manipulating the Password argument within the panelTask.bt task. unzip function locate...

CVE-2026-101009: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bttask.unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to os command injection. The attack...

PT-2026-102358

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description An issue exists in the USB Device Management API within the file usr/lib/lua/luci/controller/api/zrUsb.lua. A remote attacker can perform command injection by manipulating the path argument passed...

PT-2026-102398

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup wifi. Executing a manipulation of the argument login pwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2026-101187: Improper Neutralization of Special Elements used in a Command

A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function popusbdevice of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component USB Device Management API. This manipulation of the argument path causes command injection. The attack is...

PT-2026-99869

Name of the Vulnerable Software and Affected Versions NooBaa affected versions not specified Description An OS command injection flaw exists in the set hostname internal function of the 'cluster internal api' component, which manages the Multi-Cloud Object Gateway in OpenShift Data Foundation. Th...

PT-2026-99907

Name of the Vulnerable Software and Affected Versions Netcore NR289-GE version 1.4.5102 Description An OS command injection flaw exists in the Location Time Handler component. The issue occurs when the mac argument is manipulated within the system function of the '/location time.cgi' endpoint,...