192503 matches found
Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection
A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file listbaseconfig.php of the component Web Interface. The manipulation of the argument template leads to os command injection. It is possible...
NUUO NVR camera `debugging_center_utils_.php` - Command Execution
debuggingcenterutils.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter. id: CVE-2016-5674 info: name: NUUO NVR camera debuggingcenterutils.p...
CyberPanel - Command Injection
CyberPanel contains a command injection vulnerability in the /ftp/getresetstatus and /dns/getresetstatus endpoints.The vulnerability exists due to improper validation of the 'statusfile' parameter, which is directly used in a shell command.The security middleware only validates POST requests,...
TerraMaster TOS - Unauthenticated Remote Command Execution
TerraMaster TOS = 4.2.06 is susceptible to a remote code execution vulnerability which could allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php via the Event parameter. id: CVE-2020-28188 info: name: TerraMaster TOS - Unauthenticated Remote Command Execution...
CVE-2026-66088 Unrestricted Command Execution via system.execute
In openEQUELLA before 2026.1, the system.execute function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of t...
EUVD-2026-112564
In openEQUELLA before 2026.1, the system.execute function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of t...
CVE-2026-66088
The openEQUELLA application (versions before 2026.1 ) is vulnerable to OS Command Injection due to the system.execute() function in its scripting engine. This function executes supplied operating system commands without any validation or an allow-list of permitted executables. A user with the abi...
invoker
Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...
EUVD-2026-112499
Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell...
EUVD-2026-112493
CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::linkclicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted...
PT-2026-132331
Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.7 Progress Software WS FTP Server versions prior to 2025.0.4 Description Missing authorization in the administrative interface on Windows allows a delegated Host Administrator to exceed...
CVE-2026-90863: Progress Software WS_FTP Server: Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and…
Missing authorization in the administrative interface of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and...
CVE-2026-104328: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to…
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-107326: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to…
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-107044
Insecure permissions in ProjectMAXS MAXS Main v0.5.19 versionCode 19 allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism...
CVE-2026-107044
Insecure permissions within ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allow unauthorized attackers to arbitrarily manipulate the application's MAXS command/transport mechanism . The vulnerability is associated with CWE-732 (Incorrect Permission Assignment for Critical Resource). While the ri...
PT-2026-132103
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product...
PT-2026-132501
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the...
CVE-2026-119282: nrwl, @nx: Nx is a monorepo solution for TypeScript and polyglot codebases
Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command argument...