EUVD-2026-53316

The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...

CVE-2017-9328

Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root...

Another small metacharacter bug in Penguin Traceroute v1.0

Hi, As I was surfing through some older Securityfocus archives I stumbled across the article about Penguin traceroute v1.0 http://online.securityfocus.com/archive/1/263285 This article described some metacharacter bugs in this CGI script, also it included a suggested fix. quote Fix === Open up th...

Metacharacterbug in Fastgraf whois.cgi

Metacharacterbug in the Fastgraf whois.cgi perlscript ----------------------------------------------------- Author : Fastgraf c All rights reserved. url : http://www.fastgraf.com realeasedate : 03/01/99 Problem: The whois.cgi script of Fastgraf has almost no metacharcterchecking which enables...