EUVD-2026-95148

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-107703

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-107703

The @enmaso/node-convert library (versions through 1.0.0) contains an OS command injection vulnerability in the convert.js component. The root cause is the use of unsanitized filepath and convertTo arguments when executing ImageMagick commands via child_process.exec() . Attackers can inject shell...

CVE-2026-107699

The ppt2png utility (versions through 0.0.6 ) is vulnerable to an OS command injection vulnerability. The root cause is the use of unsanitized input or output path arguments in the ppt2png.js file, specifically where shell metacharacters (e.g., ';' ) are passed to child_process.exec() . This allo...

EUVD-2026-95145

ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to childprocess.exec in ppt2png.js,...

CVE-2026-107699 ppt2png through 0.0.6 OS Command Injection via input and output paths

ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to childprocess.exec in ppt2png.js,...

CVE-2026-105110

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter...

EUVD-2026-94812

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter...

CVE-2026-105110

The Iskratel Innbox GPON ONT devices are vulnerable to OS Command Injection in the login.xgi CGI endpoint . This vulnerability allows an unauthenticated remote attacker to execute arbitrary commands with root privileges by exploiting the CLI parameter . The impact is critical, potentially leading...

CVE-2026-105110 Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter...

innbox_root

Innbox G74/M84 - Unauthenticated Remote Code Execution via log...

Exploit for OS Command Injection in Gnu Bash

Shellshock CVE-2014-6271 Vulhub's b...

CVE-2026-107459

The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server...

CVE-2026-107459 Openfind｜SecuShare Pro - OS Command Injection

The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server...

EUVD-2026-94759

The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server...

CVE-2026-107459

The SecuShare Pro software, developed by Openfind , is susceptible to an OS Command Injection vulnerability (CWE-78 ). This flaw allows unauthenticated remote attackers to inject and execute arbitrary OS commands directly on the server. The vulnerability is classified as CRITICAL with a CVSS 3.1 ...

CVE-2026-94581

An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with...

CVE-2026-94579

An OS command injection vulnerability exists in the PAM Pluggable Authentication Module session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service...

CVE-2026-87677

An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associat...

CVE-2026-94579

An OS command injection vulnerability exists in the PAM Pluggable Authentication Module session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service...