CVE-2026-2184 Great Developers Certificate Generation System csv.php os command injection

A vulnerability was detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This vulnerability affects unknown code of the file /restructured/csv.php. The manipulation of the argument photo results in os command injection. The attack can be...

CVE-2026-2155

The CVE-2026-2155 entry concerns D-Link DIR-823X (version 250416) and the Configuration Handler’s /goform/set_dmz component. The flaw resides in function sub_4208A0, where manipulating the arguments dmz_host/dmz_enable enables operating system command injection. This allows remote execution of co...

CVE-2026-2143

A security vulnerability has been detected in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/setddns of the component DDNS Service. The manipulation of the argument ddnsType/ddnsDomainName/ddnsUserName/ddnsPwd leads to os command injection. The attack is...

CVE-2026-2131 XixianLiang HarmonyOS-mcp-server input_text os command injection

A vulnerability was identified in XixianLiang HarmonyOS-mcp-server 0.1.0. This vulnerability affects the function inputtext. The manipulation of the argument text leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used...

CVE-2026-2120

CVE-2026-2120 affects D-Link DIR-823X 250416. The issue is an OS command injection in the Configuration Parameter Handler, triggered by manipulating arguments in /goform/set_server_settings (terminal_addr, server_ip, server_port). The attack can be remote and publicly available exploits exist. Af...

CVE-2026-2120 D-Link DIR-823X Configuration Parameter set_server_settings os command injection

A vulnerability was identified in D-Link DIR-823X 250416. This affects an unknown function of the file /goform/setserversettings of the component Configuration Parameter Handler. The manipulation of the argument terminaladdr/serverip/serverport leads to os command injection. The attack may be...

D-Link DIR-823X: Operating System Command Injection Vulnerability

The D-Link DIR-823X is a wireless router produced by D-Link Corporation. The D-Link DIR-823X 250416 version has a vulnerability related to operating system command injection. This vulnerability arises from incorrect operations on the parameters interface/destip/netmask/gateway/metric in the...

D-Link DIR-823X: Operating System Command Injection Vulnerability

The D-Link DIR-823X is a wireless router produced by D-Link Corporation. The D-Link DIR-823X 250416 version has a vulnerability related to operating system command injection. This vulnerability stems from incorrect operations on the function sub420688 within the file/goform/setqos, which may lead...

UTT 521G: Operating System Command Injection Vulnerability

UTT 521G is a router produced by the Chinese company Aite UTT. The version UTT 521G 3.1.1-190816 contains a vulnerability related to operating system command injection. This vulnerability arises from improper handling of the parameter policyNames in the function sub446B18 within the...

PT-2026-6988

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X version 250416 Description A security issue exists in D-Link DIR-823X version 250416. The sub 4175CC function within the /goform/set static route table file is susceptible to OS command injection. Manipulation of the interface,...

Linux SMB Server Heap Buffer Overflow DoS

The vulnerability of the smb2getname function in the fs/smb/server/smb2pdu.c module of the SMB server implementation in Linux operating systems is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-1731 Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)

BeyondTrust Remote Support RS and certain older versions of Privileged Remote Access PRA contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the...

CVE-2025-69212 OpenSTAManager has an OS Command Injection in P7M File Processing

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M signed XML file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a...

EUVD-2025-206884

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M signed XML file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a...

OpenSTAManager has an OS Command Injection in P7M File Processing

Summary A critical OS Command Injection vulnerability exists in the P7M signed XML file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server. Vulnerable Code File:...

CVE-2026-1769

Xerox CentreWare Web on Windows is affected by a Stored XSS in CentreWare Web versions through 7.0.6. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and potentially executed in the context of other users’ sessions...

[SECURITY] Fedora 42 Update: openqa-5^20250711git28a0214-4.fc42

openQA is a testing framework that allows you to test GUI applications on one hand and bootloader and kernel on the other. In both cases, it is difficult to script tests and verify the output. Output can be a popup window or it can be an error in early boot even before init is executed. openQA is...

EPyT-Flow code issue vulnerabilities

EPyT-Flow is an open-source Python package developed by ERC Synergy Grant Water Futures, designed for generating hydraulic and water quality scenario data for water distribution networks. Versions of EPyT-Flow prior to 0.16.1 contained code vulnerabilities. These vulnerabilities stemmed from the...

Gogs operating system command injection vulnerability

Gogs Go Git Service is a Go-based self-service Git hosting service developed by the Gogs team. It supports creating and migrating public/private repositories, as well as adding and removing repository collaborators. Gogs versions 0.13.3 and earlier had an operating system command injection...

OpenProject operating system command injection vulnerability

OpenProject is an open-source web-based project management software. Versions of OpenProject prior to 16.6.7 and 17.0.3 had a vulnerability related to operating system command injection. This vulnerability stemmed from an arbitrary file writing vulnerability present in the repository modification...