10253 matches found
CVE-2025-49141
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the gitImportSite functionality obtains a URL string from a POST request and insufficiently validates user input. The setremote function later passes this input into procopen, yielding OS...
OS Command Injection
@haxtheweb/haxcms-nodejs is vulnerable to OS command injection. The vulnerability is due to insufficient input validation in the gitImportSite functionality, which allows attacker-controlled input to reach the procopen function through a crafted URL string...
EUVD-2025-17710
Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105...
CVE-2025-31104
An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 in FortiADC 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.7, 7.1.0 through 7.1.4, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated attacker...
CVE-2025-31104
An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 in FortiADC 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.7, 7.1.0 through 7.1.4, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated attacker...
CVE-2025-31104
An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 in FortiADC 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.7, 7.1.0 through 7.1.4, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated attacker...
CVE-2025-31104
An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 in FortiADC 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.7, 7.1.0 through 7.1.4, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated attacker...
CVE-2025-31104
An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 in FortiADC 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.7, 7.1.0 through 7.1.4, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated attacker...
CVE-2025-31104
FortiADC is affected by CVE-2025-31104 due to OS command injection (CWE-78) from improper neutralization of special elements in crafted HTTP requests. Affected versions include FortiADC 6.1, 6.2, and 7.0 through 7.6.1 (encompassing 7.0, 7.1.0–7.1.4, 7.2.0–7.2.7, 7.4.0–7.4.6, and 7.6.0–7.6.1). An ...
CVE-2025-4678
Improper Neutralization of Special Elements in the chromiumpath variable may allow OS command injection. This issue affects Pandora ITSM 5.0.105...
CVE-2025-4653
Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105...
CVE-2024-13089
An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands. Users with administrative privileges may upload update packages to upgrade the versions of Nozomi Networks Guardian and CMC. While these...
CVE-2024-13089 Authenticated RCE in update functionality in Guardian/CMC before 24.6.0
An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands. Users with administrative privileges may upload update packages to upgrade the versions of Nozomi Networks Guardian and CMC. While these...
CVE-2024-13089
CVE-2024-13089 describes an OS command injection vulnerability in the update functionality of Nozomi Networks Guardian and CMC. The issue allows an authenticated administrator (high-privilege user) to upload update packages, and despite signatures being validated, an improper signature validation...
CVE-2025-5743
CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause remote control over the charging station when an authenticated user modifies configuration parameters on the web server...
CVE-2025-5743
CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause remote control over the charging station when an authenticated user modifies configuration parameters on the web server...
CVE-2025-5743
CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause remote control over the charging station when an authenticated user modifies configuration parameters on the web server...
CVE-2025-5743
The CVE-2025-5743 entry concerns Schneider Electric EVLink WallBox (home charging station) with an OS command injection flaw (CWE-78). The vulnerability arises from improper neutralization of OS command elements, enabling remote control of the charging station when an authenticated user changes c...