...[ More ]

Tozed ZLT X300 5G CPE Router firmware version 6.01.3 contains an OS command injection vulnerability in the TR-069/CWMP client daemon netcwmpd. The IPPingDiagnostics Host parameter is passed unsanitized into sprintf, which constructs a shell command executed via systembyroot as root. An attacker...

Security Advisory 0181

Security Advisory 0181 PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-86108 CVSSv3.1 Base Score: 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVSSv4.0 Base Score: 7.5...

cve-2019-14514

CVEID : CVE-2019-14514 受影响产品及版本名称 : Microvirt MEmu（所有 7.0.2 之前的版本） 问题类型 : CWE-78：OS 命令中特殊元素未正确清理（'OS 命令注入'） 概述 MEmu 是一款适用于 Windows 的安卓模拟器。在测试过程中，我们发现了一个开放的 TCP 端口，可能被利用以获取 root 权限下的代码执行能力。 所有 7.0.2 之前的 Microvirt MEmu 版本都包含一个存在漏洞的二进制文件，该文件在端口 21509 上监听。攻击者可以通过发送包含用作 Unix shell...

CVE-2019-25065-exploit

CVE-2019-25065 - POC これはCVE-2019-25065のPOCです - OpenNetAdmin v18.1.1のOSコマンドインジェクション エクスプロイトはbashで書かれており、linux環境をサポートしています。 kali linux 2024.4、およびUbuntu 22.04.5 LTSでテスト済みです。 依存関係: gridsite-clients debianパッケージ...

CVE-2025-26055

CVE-2025-26055 CVE 描述 作者：Rohan Deshpande 操作系统命令注入 摘要 操作系统命令注入是一种安全漏洞，攻击者能够通过易受攻击的应用程序在宿主操作系统上执行任意命令。这可能导致未授权访问、数据泄露和系统受损。 影响 操作系统命令注入的影响包括：未授权访问系统资源、数据窃取、系统受损，以及可能完全控制受影响服务器，从而导致严重的安全漏洞和运营中断。 受影响 URL http://:/generateTrackRoute 建议 为了缓解操作系统命令注入漏洞，应对所有用户输入进行验证和清理，使用参数化命令或...

cve-2015-2208

CVE-2015-2208 の環境をシミュレートするための Dockerfile phpMoAdmin 1.1.2 の moadmin.php 内の saveObject 関数は、リモートの攻撃者が object パラメータ内のシェルメタ文字を介して任意のコマンドを実行することを許可します。 発見者: @u0x Pichaya Morimoto, Xelenonz, pe3z, Pistachio 参考文献: http://seclists.org/fulldisclosure/2015/Mar/19 http://www.exploit-db.com/exploits/36251/...

CVE-2026-82004

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...

CVE-2026-82004 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...

EUVD-2026-73944

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...

CVE-2026-82004

Adobe Campaign Classic (ACC) is affected by an OS Command Injection vulnerability (CWE-78) that allows a remote, unauthenticated attacker to execute arbitrary code in the context of the current user. The vulnerability is rated CVSS 10.0 (CRITICAL) with a network attack vector, low complexity, no ...

CVE-2026-48030

CVE-2026-48030 — Pheditor における OS コマンドインジェクション 概要...

CVE-2021-46422

CVE-2021-46422 SDT-CW3B1 1.1.0 - OSコマンドインジェクション root@kitploit: Exploit Title: SDT-CW3B1 1.1.0 - OS Command Injection Vendor Homepage: http://telesquare.co.kr/ CVE : CVE-2021-46422 CVE Description: Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote...

CVE-2026-81349

Improper neutralization of special elements used in an os command 'os command injection' in Azure HDInsights allows an authorized attacker to elevate privileges over a network...

GHSA-XP7J-H7JC-4W8P Semaphore U: OS Command Injection

Summary An OS command injection in repository giturl handling lets any user holding the Manager or Owner role on any project the normal project-collaborator roles achieve remote code execution on the Semaphore server host. Using git's --upload-pack= option, an attacker runs arbitrary commands. Th...

CVE-2026-81349

Azure HDInsight is affected by an OS command injection vulnerability in its Ambari component, resulting from improper neutralization of special elements used in OS commands. An authorized attacker can leverage this flaw over the network to elevate privileges , potentially compromising confidentia...

EUVD-2026-73328

Improper neutralization of special elements used in an os command 'os command injection' in Azure HDInsights allows an authorized attacker to elevate privileges over a network...

Security Bulletin: Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

Summary Langflow uses a code security scanner and component-level execution policies to restrict server-side code execution to authorized users and contexts. The agentic assistant code scanner employs an incomplete denylist omitting process-spawning primitives and contains a logic error where...

CVE-2026-61517

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a...

Vulnerability-CVE-2025-64446-CVE-2025-58034

FortiWeb エクスプロイトシミュレーション CVE-2025-64446 & CVE-2025-58034 注意: このドキュメントは学習およびセキュリティ研究目的のみです。 許可なくシステムを攻撃するために使用しないでください。 1. 概要 FortiWebはWebアプリケーションファイアウォール（WAF）であり、Webアプリケーションを保護するために使用されます。 2025年には、2つの深刻な脆弱性が発見されました： CVE-2025-64446 – パストラバーサルによる認証バイパス CVE-2025-58034 – OSコマンドインジェクション 2...

CVE-2026-61517 Netis NX10 OS Command Injection via Ping Diagnostic Handler

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a...