17835 matches found
OS Command Injection
com.powsybl, powsybl-computation-local is vulnerable to OS command injection. The vulnerability is due to insufficient escaping of attacker-controlled command arguments and environment variables before they are passed to shell interpreters, which allows an attacker to inject and execute arbitrary...
EUVD-2026-67958
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from...
CVE-2026-19295
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from...
CVE-2026-75121
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...
CVE-2026-75123
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...
CVE-2026-75122
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A...
CVE-2026-37751
An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...
CVE-2026-75486 Synk Sweater Comb < 3.8.8 Command Injection via .vervet.yaml Branch Name
Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters..optic-ci.original branch name field. The expectGitBranch function in...
CVE-2026-75486 Synk Sweater Comb < 3.8.8 Command Injection via .vervet.yaml Branch Name
Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters..optic-ci.original branch name field. The expectGitBranch function in...
EUVD-2026-67783
PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...
CVE-2026-75123 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...
CVE-2026-75122 PLANET GS-4210-16P2S V3 Command Injection via httpuploadcert.cgi
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A...
CVE-2026-75122 PLANET GS-4210-16P2S V3 Command Injection via httpuploadcert.cgi
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A...
EUVD-2026-67782
PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A remote...
EUVD-2026-67781
PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...
CVE-2026-75121 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...
CVE-2026-75121 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...
CVE-2026-75121
PLANET GS-4210-16P2S managed switches with firmware prior to 3.441b260626 are affected by an authenticated OS command injection in /cgi-bin/dispatcher.cgi. The web_vlan_membership_edit_dialog_post handler incorporates the memberTags POST parameter directly into a shell command without sanitizatio...
