483010 matches found
CVE-2026-73766
Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating...
CVE-2026-73767
Authenticated command injection vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system...
CVE-2026-73768
A vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input. Successful exploitation could result in the execution of arbitrary commands with root privileges...
CVE-2026-73751
An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system...
CVE-2026-71981
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...
CVE-2026-73524
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...
CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...
CVE-2026-71981
Cypht versions before 2.12.2 contain a PHP object injection vulnerability in the logout handler. The back_query GET parameter accepts a base64-encoded serialized payload that is passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exp...
EUVD-2026-69650
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...
CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...
CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...
GHSA-M4RF-3FR8-XWX3 NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)
Vulnerability The fix for CVE-2026-12841 CWE-88, JVM argument injection added validatejavaoptions to block dangerous JVM flags such as -agentlib, -agentpath, -javaagent, -Xrunjdwp, and @argfile references. However, the validation is only applied when setting global options via configjava. The jav...
EUVD-2026-65525
NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers incomplete fix of CVE-2026-12841...
EUVD-2026-69632
A vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input. Successful exploitation could result in the execution of arbitrary commands with root privileges...
EUVD-2026-69631
Authenticated command injection vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system...
CVE-2026-73767 Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface
Authenticated command injection vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system...
CVE-2026-73767
Authenticated command injection vulnerabilities exist in the command line interface (CLI) of HPE AOS-CX (ArubaOS-CX). Successful exploitation allows an attacker with authenticated access to execute arbitrary commands as a privileged user on the underlying operating system. The CNA-assigned CVSS 3...
CVE-2026-73766 Authenticated Command Injection Vulnerabilities in the API Endpoint of AOS-CX
Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating...
CVE-2026-73766
CVE-2026-73766 is a command injection vulnerability in the API endpoint of HPE AOS-CX . An authenticated remote attacker with administrative privileges can inject arbitrary commands, potentially executing them as a privileged user on the underlying operating system. The HPE-assigned CVSS 3.1 scor...
CVE-2026-73766 Authenticated Command Injection Vulnerabilities in the API Endpoint of AOS-CX
Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating...