1629 matches found
CVE-2025-32931
DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command...
CVE-2025-27797
OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product...
CVE-2025-25053: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability in the WEB UI the setting page exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product...
CVE-2024-54025
An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiIsolator CLI before version 2.4.6 allows a privileged attacker to execute unauthorized code or commands via crafted CLI requests...
CVE-2025-30013 Code Injection vulnerability in SAP ERP BW Business Content
SAP ERP BW Business Content is vulnerable to OS Command Injection through certain function modules. These function modules, when executed with elevated privileges, improperly handle user input, allowing attacker to inject arbitrary OS commands. This vulnerability allows the execution of unintende...
CVE-2025-27083: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Successful exploitation of these vulnerabilities allows an Authenticated attacker to execute arbitrary commands as a privileged user on the underlying...
CVE-2024-54018
Multiple improper neutralization of special elements used in an OS Command vulnerabilities CWE-78 in FortiSandbox before 4.4.5 allows a privileged attacker to execute unauthorized commands via crafted requests...
CVE-2025-22366 Mennekes smart/premium charges systems, Command injection in firmware upgrade
The authenticated firmware update capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command are improperly neutralized when certain fields are passed to the underlying OS...
CVE-2025-22368 Mennekes smart/premium charges systems, Command injection in sCU firmware update
The authenticated SCU firmware command of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS commands are improperly neutralized when certain fields are passed to the underlying OS...
CVE-2025-22367 Mennekes smart/premium charges systems, Command injection in time setting
The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command are improperly neutralized when certain fields are passed to the underlying OS...
CVE-2024-12009
A post-authentication command injection vulnerability in the "ZyEE" function of the Zyxel EX5601-T1 firmware version V5.70ACDZ.3.6C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a vulnerable device...
CVE-2024-12010
A post-authentication command injection vulnerability in the ”zyUtilMailSend” function of the Zyxel AX7501-B1 firmware version V5.17ABPC.5.3C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a vulnerable device...
CVE-2024-11253
A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version V5.50ABOM.8.5C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a...
CVE-2025-22447
Incorrect access permission of a specific service issue exists in RemoteView Agent for Windows versions prior to v8.1.5.2. If this vulnerability is exploited, a non-administrative user on the remote PC may execute an arbitrary OS command with LocalSystem privilege...
CVE-2025-24864
Incorrect access permission of a specific folder issue exists in RemoteView Agent for Windows versions prior to v8.1.5.2. If this vulnerability is exploited, a non-administrative user on the remote PC may execute an arbitrary OS command with LocalSystem privilege...
CVE-2025-24864
CVE-2025-24864 affects RemoteView Agent (Windows) prior to v8.1.5.2. Root cause: incorrect access permissions on a specific folder (CWE-276) allowing a non-administrative remote-access user to execute arbitrary OS commands with LocalSystem privileges. Impact: local user on a remote PC gains full ...
CVE-2024-53944
An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUIv1.0.1802.10.08P4 and LT21B devices through M7628xUSAxUIv2v1.0.1481.15.02P0. A unauthenticated remote attacker with network access can exploit a command injection vulnerability. The /goform/formJsonAjaxReq...
CVE-2021-46686: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in acmailer CGI ver.4.0.3 and earlier and acmailer DB ver.1.1.5 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker...
Azure Linux 3.0 Security Update: less (CVE-2024-32487)
The version of less installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-32487 advisory. - less through 653 allows OS command execution via a newline character in the name of a file, because quoting is...
