EUVD-2026-88210

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...

CVE-2026-86530

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command...

EUVD-2026-88165

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command...

CVE-2026-86530

BUFFALO Wi-Fi products are vulnerable to an arbitrary OS command execution flaw due to improper handling of certain web form inputs when assembling internal command line strings. An administrative user can exploit this by sending a crafted HTTP request . No specific version numbers, root cause fi...

CVE-2024-29375

CSV-Injection-PoC Addactis IBNRS 3.10.3.107 における CSV インジェクション AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L CVSS: 7.1, 影響スコア: 5.3, 悪用スコア: 1.3 影響を受けるコンポーネント: Project Description、Identifiers、Custom Triangle Name Input Triangles 内、および Yield Curve Name パラメータ スクリーンショット 1: メモ帳を開くために、Excelの数式をプロジェクト説明として注入する...

PT-2026-99845

Name of the Vulnerable Software and Affected Versions Apache Karaf affected versions not specified Description The instance-management service InstanceServiceImpl constructs the command line for launching a child Karaf JVM using string concatenation, which is then executed via /bin/sh on Unix or...

CVE-2026-91006: Improper Neutralization of Special Elements used in an OS Command

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...

CVE-2026-86530: Improper Neutralization of Special Elements used in an OS Command

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command...

CVE-2022-40635

CVE-2022-40635: CrafterCMS における Groovy サンドボックスバイパス Crafter CMS の Crafter Studio における動的管理コードリソースの不適切な制御の脆弱性により、認証された開発者が Groovy サンドボックスバイパスを介して OS コマンドを実行できる可能性があります。 ベンダーの開示: この脆弱性に関するベンダーの開示と修正は、こちら をご覧ください。 要件: この脆弱性を悪用するには以下が必要です: 有効なユーザー資格情報 概念実証: 詳細と悪用プロセスは、この PDF で確認できます。...

CVE-2025-56803

CVE-2025-56803 Figmaデスクトップアプリケーションにおけるプラグイン実行を介したOSコマンドインジェクションの脆弱性 1. 概要 アプリケーション : Figmaデスクトップアプリケーション バージョン : 125.6.5 ベンダー : Figma, Inc. CWE : CWE-78: OSコマンドに使用される特殊要素の不適切な無効化（'OSコマンドインジェクション'） CVSS : 8.4 ベクター文字列 : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2. 要約...

CVE-2021-27928

情報 Exploit Title: MariaDB 10.2 /MySQL - 'wsrepprovider' OS Command Execution Date: 03/18/2021 Exploit Author: Central InfoSec Version: MariaDB 10.2 before 10.2.37 10.3 before 10.3.28 10.4 before 10.4.18 10.5 before 10.5.9 Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 f...

beyondtrust-rce-scanner

CVE-2026-1731 — BeyondTrust Remote Support & PRA 预认证 RCE 概述 BeyondTrust Remote Support 和 Privileged Remote Access 中存在严重的预认证 RCE 漏洞。未经身份验证的远程攻击者可以执行操作系统命令。 字段| 值 ---|--- CVE| CVE-2026-1731 严重级别| CRITICAL 产品| BeyondTrust Remote Support & PRA CISA KEV| 2026-02-06 攻击类型| 预认证 RCE 所需认证| 无 受影响版本 状态| 版本...

PT-2026-99139

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 2.0.0 Description An issue exists in the export data function within the HorillaListView class located in horilla views/generic/cbv/views.py. The application accepts a columns POST parameter from an authenticated user...

Linux Distros Unpatched Vulnerability : CVE-2026-79310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that...

CVE-2026-79766

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

CVE-2026-61819

A flaw was found in pgpartman. A database user with partmanuser privileges can exploit a SQL injection vulnerability by crafting a malicious parent-table name. When the extension is configured to use pgjobmon, this crafted input is improperly processed during an exception, allowing the injection...

CVE-2026-14780

A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that...

EUVD-2026-85791

A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that...

PT-2026-97702

Name of the Vulnerable Software and Affected Versions PaperCut NG/MF affected versions not specified Description Insufficient sanitization and access restrictions within the embedded execution engine of the device-scripting functionality allow an authenticated user with administrative access to t...

CVE-2026-80425 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...