CVE-2026-116504 TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection

A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268B20221104. This affects the function setCloudUpgradeFW of the file lib/cstemodules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. T...

CVE-2026-116576 systeminformation: Windows command injection in services() through Unicode quotation marks

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString in lib/util.js. On Windows, the sanitizer removes ASCII...

CVE-2026-116576 systeminformation: Windows command injection in services() through Unicode quotation marks

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString in lib/util.js. On Windows, the sanitizer removes ASCII...

CVE-2026-116576 systeminformation: Windows command injection in services() through Unicode quotation marks

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString in lib/util.js. On Windows, the sanitizer removes ASCII...

CVE-2026-116576

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString in lib/util.js. On Windows, the sanitizer removes ASCII...

Command Injection

Overview systeminformation is a simple system and OS information library. Affected versions of this package are vulnerable to Command Injection via the services function on Windows, due to insufficient sanitization of shell strings in sanitizeShellString within lib/util.js. An attacker who contro...

CVE-2026-116576

The systeminformation library for node.js is vulnerable to Windows command injection in the services() function prior to version 5.33.16 . The root cause is that the sanitizeShellString() function in lib/util.js fails to filter Unicode quotation marks , which PowerShell accepts as string delimite...

CVE-2021-3060

CVE-2021-3060 POC/ Exploit Description: An OS command injection vulnerability in the Simple Certificate Enrollment Protocol SCEP feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root us...

Command Injection

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Command Injection via unrestricted Pillow image format handling in loadbytes and topil when processing untrusted multimodal media. An attacker can...

PYSEC-2026-4346

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.openBytesIOdata without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request...

SUSE CVE-2026-115774

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox stat...

Ahsay CBS CVE-2026-105134 UpdateReceivers command injection

CVE-2026-105134: Ahsay AhsayCBS Replication Receiver POST /rps/api/json/UpdateReceivers.do passes the JSON random field into a shell command without sanitization. Supports confirm-only echo injection whoami/id when stdout is reflected in JSON, or time-based check. !/usr/bin/env python3 -- coding:...

Teltonika RutOS ipsec status logread command injection

Post-authentication OS command injection in Teltonika RutOS 00.07.06.21 RUT2XX / RUT200; RUT9XX byte-identical ipsec.lua. GET /api/ipsec/status/ passes the URL-decoded sid into logread -e '-c|' without shell quoting; vuci.util.exec runs /bin/sh -c and returns stdout in JSON .data.logs reflective...

motionEye CVE-2025-60787 root command injection

CVE-2025-60787 motionEye /set with imagefilename $cmd — executed as root on the next interval snapshot. signingkey must be the SHA1 of the admin password same value stored as @adminpassword in motion.conf. !/usr/bin/env python3 -- coding: utf-8 -- """motionEye CVE-2025-60787 authenticated...

OpenNetAdmin CVE-2019-25065 xajax RCE

CVE-2019-25065 OpenNetAdmin = 18.1.1: unauthenticated command injection via xajaxargs in windowsubmit requests. !/usr/bin/env python3 -- coding: utf-8 -- """OpenNetAdmin CVE-2019-25065 unauthenticated xajax command injection.""" from future import annotations import re import time from kittysploi...

Ahsay CBS CVE-2026-105134 UpdateReceivers detect

Detects POST /rps/api/json/UpdateReceivers.do used in CVE-2026-105134 OS command injection via unsanitized random parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Ahsay CBS-style UpdateReceivers endpoint CVE-2026-105134 pattern.""" import json from kittysploit import from...

Fortinet FortiSandbox CVE-2026-39808 Detect

Fingerprints FortiSandbox web UI and the tracer-behavior endpoint associated with CVE-2026-39808 jid parameter command injection. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FortiSandbox CVE-2026-39808 tracer-behavior injection surface.""" from kittysploit import from...

Fortinet FortiSandbox CVE-2026-39808 OS command injection

CVE-2026-39808 FortiSandbox 4.4.0–4.4.8: unauthenticated OS command injection via the jid query parameter on /fortisandbox/job-detail/tracer-behavior. Output is written to /web/ng/test.txt and retrieved over HTTP. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiSandbox CVE-2026-39808...

Webmin CVE-2019-12840 Package Updates RCE

CVE-2019-12840: authenticated command injection in POST /package-updates/update.cgi via slash-free base32-decoded shell in the u= parameter Webmin = 1.920. !/usr/bin/env python3 -- coding: utf-8 -- """Webmin CVE-2019-12840 authenticated Package Updates command injection.""" from future import...

OpenSTAManager CVE-2025-69212 P7M import RCE

CVE-2025-69212 OpenSTAManager = 2.9.8: authenticated importFEZIP upload passes unsanitized .p7m entry names into openssl exec, enabling shell command injection ZIP names must avoid '/' characters. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSTAManager CVE-2025-69212 P7M filename command...