The vulnerability of the TOPAZ Metron PTS time synchronization device, related to the failure to implement measures to neutralize special elements, allows intruders to inject arbitrary OS commands.

The vulnerability of the TOPAZ Metron PTS time synchronization device is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to inject arbitrary OS commands...

odat

Quentin HARDY --- [email protected] [email protected] ODAT ODAT Oracle Database Attacking Tool is an open source penetration testing tool that tests the security of Oracle Databases remotely. Usage examples of ODAT: You have an Oracle database listening remotely and want to find valid...

CVE-2026-107700

dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...

CVE-2026-107204

LMCache versions through 0.5.5 are vulnerable to an unauthenticated remote code execution (RCE) vulnerability via the /run_script endpoint. The root cause is that attackers can post scripts to this endpoint and recover real builtins through the injected FastAPI app object , which allows them to b...

EUVD-2026-94122

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command 'Code Injection', aka improper control of code generation...

CVE-2026-97674

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command 'Code Injection', aka improper control of code generation...

CVE-2025-71384

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...

CVE-2026-104069 HortusFox < 6.2 Remote Code Execution via Theme Import

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

EUVD-2025-211035

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...

CVE-2025-71384

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...

PT-2026-106806

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...

CVE-2025-71384

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...

CVE-2024-20356

CVE-2024-20356 Esta es una prueba de concepto para CVE-2024-20356, una vulnerabilidad de inyección de comandos en Cisco CIMC. Los detalles técnicos completos se pueden encontrar en https://labs.nettitude.com/blog/cve-2024-20356-jailbreaking-a-cisco-appliance-to-run-doom Uso Usage: CVE-2024-20356....

CVE-2022-30525

CVE-2022-30525 Inyección de comandos remota en Zyxel Firewall Un exploit basado en Python para CVE-2022-30525 Resumen de la vulnerabilidad NIST Una vulnerabilidad de inyección de comandos del sistema operativo en el programa CGI de Zyxel USG FLEX 100W, con versiones de firmware de la 5.00 a la 5....

AlmaLinux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1789602943)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789602943 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and...

Rocky Linux 8 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc (crlsa-2020_4453)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20204453 advisory. vim: users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode CVE-2019-20807 Tenable has extracted the preceding description blo...

Rocky Linux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1789602943)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789602943 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and...

CVE-2026-102142

A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance...

EUVD-2026-90299

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in ...

CVE-2026-102136 Kiteworks Core Command Execution through Configuration Injection

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be...