HuangDou UTCMS V9 - OS Command Injection

A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection.The attack may be launched remotely. The...

pfSense pfBlockerNG <=2.1..4_26 - OS Command Injection

pfSense pfBlockerNG through 2.1.426 is susceptible to OS command injection via root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected. id: CVE-2022-31814 info: name: pfSense pfBlockerNG =2.1..427 to mitigate this vulnerability. reference: -...

CVE-2023-6019

Ray OS 命令注入 RCE（未授权） 使用方法： 1. nc -lvnp 4444 2. python3 cve-2023-6019.py -t 192.168.1.13 -p 80 -L 192.168.1.14 -P 80...

CVE-2026-82887

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-84085

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection due to improper neutralization of special elements in OS commands, allowing a remote attacker to execute arbitrary OS commands. The CVSS v3.1 score is 8.1 (HIGH) with a network attack vector, high complexity, no privileges re...

EUVD-2026-83421

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a shell command executed by the application, potentially resulting in...

CVE-2026-82892

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection caused by improper neutralization of special elements in an OS command, allowing a remote attacker to execute arbitrary commands. The flaw requires no prior authentication or user interaction but has a high attack complexity ...

EUVD-2026-83313

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-80442

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection in the exportCertificate functionality. A low-privilege attacker with network access can execute unauthorized commands, impacting confidentiality, integrity, and availability of the affected system. The CVSS ...

EUVD-2026-83302

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allow an attacker to execute unauthorized commands and impact the confidentiality, integrity, and availability of the affect...

CVE-2026-80442 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allow an attacker to execute unauthorized commands and impact the confidentiality, integrity, and availability of the affect...

CVE-2026-93533

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

CVE-2026-14802

CVE-2026-14802 脆弱なソフトウェア名と影響を受けるバージョン create-react-app 5.0.2 より前のバージョン 説明 macOS 上では、react-dev-utils コンポーネントの openBrowser.js ファイル内の startBrowserProcess 関数が OS コマンドインジェクションを許容します。この問題により、指定された関数を操作することでリモートから悪用される可能性があります。 推奨事項 暫定的な回避策として、パッチが利用可能になるまで startBrowserProcess 関数の使用を制限してください。...

CVE-2026-81942

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system without sufficient filtering, allowing a remote authenticated attacker to...

CVE-2026-93533

spatie Scotty (a Laravel package) is affected by an OS command injection in the Doctor Command Handler component, specifically in the DoctorCommand::checkSshConnectivity and DoctorCommand::checkRemoteTools functions within app/Commands/DoctorCommand.php. The vulnerability exists in versions up to...

CVE-2026-93533 spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

CVE-2026-9645-ScadaBR-Analysis

CVE-2026-9645 — ScadaBR 漏洞分析 针对 CVE-2026-9645 的技术漏洞分析与 CVE 简报，该漏洞影响开源 ScadaBR SCADA/HMI 平台 。 概述 CVE-2026-9645 是 ScadaBR 中的一个严重已认证远程代码执行漏洞。 根据已准备的简报： 严重程度： 严重 CVSS v3.1： 9.9 漏洞类型： 已认证远程代码执行 CWE： CWE-78 — 操作系统命令注入 受影响产品： ScadaBR 所需访问权限： 低权限已认证账户 用户交互： 无 受影响版本： 所有已知版本 补丁状态： 无官方补丁可用；该项目已停止维护 漏洞摘要...

CVE-2025-14754 IBM Cloud Pak for Data is vulnerable to OS command injection

IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input...

CVE-2025-14754

IBM Cloud Pak for Data 5.1.2 is vulnerable to OS command injection (CWE-78) due to improper validation of user-supplied input. An authenticated remote attacker can exploit this to execute arbitrary commands with elevated privileges, potentially leading to full system compromise. The CVSS 3.1 base...

CVE-2026-81942 PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Server

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system without sufficient filtering, allowing a remote authenticated attacker to...