96599 matches found
CVE-2026-75121
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...
CVE-2026-75122
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A...
CVE-2026-75123
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...
CVE-2026-55673
PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...
CVE-2026-55559
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/instance into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The...
GHSA-JQVF-J3WW-R8C7 PowSyBl Core has Command Injection in LocalCommandExecutor-s
Impact Description Both AbstractLocalCommandExecutor OS-dependent implementations are subject to CWE-78 OS Command Injection, with a secondary CWE-88 Argument Injection concern via environment variables. The local command executor build command strings via concatenation and executes them through...
PowSyBl Core has Command Injection in LocalCommandExecutor-s
Impact Description Both AbstractLocalCommandExecutor OS-dependent implementations are subject to CWE-78 OS Command Injection, with a secondary CWE-88 Argument Injection concern via environment variables. The local command executor build command strings via concatenation and executes them through...
EUVD-2026-67863
PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...
CVE-2026-55673 PowSyBl: Command Injection in LocalCommandExecutor-s
PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...
CVE-2026-55673 PowSyBl: Command Injection in LocalCommandExecutor-s
PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...
CVE-2026-55673
PowSyBl (Power System Blocks), a framework for building power system software, is affected by a command injection vulnerability prior to version 7.2.2. The UnixLocalCommandExecutor and WindowsLocalCommandExecutor components concatenate attacker-controlled arguments and environment variables into ...
CVE-2026-55673
PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...
CVE-2026-55673 PowSyBl: Command Injection in LocalCommandExecutor-s
PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...
CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values
JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...
EUVD-2026-67859
JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...
CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values
JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...
CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values
JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...
CVE-2026-55378
JS Recon is a JavaScript enumeration and SAST tool. In versions 1.2.1-beta.1 through 1.3.1-beta.2 , the PR Branch Checker workflow in .github/workflows/pr_checker.yml interpolates untrusted values (github.head_ref and github.event.pull_request.head.repo.full_name) directly into a shell gh pr comm...
CVE-2026-50979
A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...