CVE-2025-13284

ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

CVE-2025-55055

CWE-78 Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...

CVE-2025-55055

CVE-2025-55055 pertains to an OS command injection in Maxum Rumpus FTP Server 9.0.12, caused by improper neutralization of special elements. This could allow an attacker to execute arbitrary commands on the affected system. Public details about a fix are not provided in the connected documents; m...

CVE-2025-55055

CWE-78 Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...

CVE-2025-63916

MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. The application fails to properly sanitize user-supplied file paths before passing them to cmd.exe, allowing attackers to execute arbitrary system commands with the privileges of the user...

PT-2025-47112

Name of the Vulnerable Software and Affected Versions ThinPLUS affected versions not specified Description ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability. This allows unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. The...

CVE-2025-63916

Summary : CVE-2025-63916 affects MyScreenTools v2.2.1.0. The issue is a critical OS command injection in the GIF compression tool, where the CMD() function in GIFSicleTool/Form_gif_sicle_tool.cs concatenates unsanitized user input (file paths) and executes them via cmd.exe. This allows arbitrary ...

CVE-2025-63916

MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. The application fails to properly sanitize user-supplied file paths before passing them to cmd.exe, allowing attackers to execute arbitrary system commands with the privileges of the user...

CVE-2025-64444

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in NCP-HG100 1.4.48.16 and earlier. If exploited, a remote attacker who has obtained the authentication information to log in to the management page of the product may execute an arbitrary OS...

CVE-2025-64444

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in NCP-HG100 1.4.48.16 and earlier. If exploited, a remote attacker who has obtained the authentication information to log in to the management page of the product may execute an arbitrary OS...

CVE-2025-64444

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in NCP-HG100 1.4.48.16 and earlier. If exploited, a remote attacker who has obtained the authentication information to log in to the management page of the product may execute an arbitrary OS...

CVE-2025-64444

CVE-2025-64444 affects NCP-HG100 (1.4.48.16 and earlier). The issue is an OS command injection due to improper neutralization of special elements in commands, allowing a remote attacker who has authenticated access to the management page to execute arbitrary OS commands with root privileges. Red ...

CVE-2025-42892 OS Command Injection vulnerability in SAP Business Connector

Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating...

PT-2025-46232

Name of the Vulnerable Software and Affected Versions SAP Business Connector affected versions not specified Description An OS Command Injection issue exists in SAP Business Connector. An authenticated attacker with administrative access and adjacent network access can upload specially crafted...

foreman: OS command injection via ct_location and fcct_location parameters

A flaw was found in Red Hat Satellite Foreman component. This vulnerability allows an authenticated user with editsettings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting...

Evernote MCP Server 操作系统命令注入漏洞

Evernote MCP Server is a Large Model Context Protocol server for brentmid individual developers. Evernote MCP Server suffers from an operating system command injection vulnerability that stems from the openBrowser function not properly validating a user-supplied string, which could lead to...

CVE-2025-61304

OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address...

OS Command Injection

@sequa-ai/sequa-mcp is vulnerable to OS Command Injection. Thee vulnerability is due to improper validation of redirect URLs due to the redirectToAuthorization function opening unvalidated/non-sequa URLs. An attacker can exploit this by supplying a crafted redirect URL to trigger remote OS comman...

CVE-2025-61304

OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address...

CVE-2025-61304

CVE-2025-61304 is an OS command injection vulnerability in the Dynatrace ActiveGate ping extension, affected up to version 1.016. The root cause is improper handling of crafted IP addresses in the ping extension, which relies on the Windows command prompt and allows command chaining (e.g., via an...