CVE-2026-58571

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-58571

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-58571

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-13336

CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause execution of Linux Operating system commands when a system back up is restored that has been maliciously modified...

CVE-2026-13336

CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause execution of Linux Operating system commands when a system back up is restored that has been maliciously modified...

EUVD-2026-69031

LibreNMS versions = 23.10.0 and getDevice-hostname is concatenated into shell commands ssh, virsh list/dumpxml/domstate in VminfoLibvirt.php and passed to exec without escapeshellarg or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands,...

CVE-2026-84194

LibreNMS versions >= 23.10.0 and

Acmailer - Improper Access Control to OS Command Injection

Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows remote attackers to execute an arbitrary OS command, or gain an administrative privilege which may result in obtaining the sensitive information on the server via unspecified...

Group-Office < 26.0.5 - Remote Code Execution

Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmpfile into an exec call. By injecting shell metacharacters into...

Palo Alto Networks Expedition - OS Command Injection

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls...

WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection

A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection...

Pheditor 2.0.1-2.0.3 - OS Command Injection

Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges. id: CVE-2026-48030 info: name: Pheditor 2.0.1-2.0.3 - OS...

CVE-2026-59681

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads...

CVE-2026-59680

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...

CVE-2026-25706

Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root ...

CVE-2026-25706

CVE-2026-25706 is an OS command injection in yast2-samba-client (SUSE), triggered when an attacker-controlled Organizational Unit (OU) value from an Active Directory directory tree is passed unsanitized to an OS command during interactive domain join. A rogue domain controller or a directory user...

EUVD-2026-69001

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads...

CVE-2026-59680

An OS command injection vulnerability in yast2-users (through 5.0.8 ) allows root-level command execution via a malicious LDAP directory. The flaw is in get_password_term() in src/include/users/dialogs.rb, which reads the shadowLastChange and shadowExpire attributes via GetString() with no numeri...

CVE-2023-30854

WWBN Avideo Authenticated RCE - OS Command Injection CVE-2023-30854 WWBN Avideo sqlFile $objClone-cloneSiteURLvideos/cache/clones/$json-sqlFile"; $log-add"Clone 2 of $totalSteps: Geting MySQL Dump file"; exec$cmd . " 2&1", $output, $returnval; We can control $objClone-cloneSiteURL through the adm...

Simulation_CVE-2024-46256

CVE-2024-46256 & CVE-2024-46257 – PoC Simulation Overview This repository contains a step-by-step, image-backed Proof of Concept PoC simulating two vulnerabilities in Nginx Proxy Manager that enable OS Command Injection, leading to Remote Code Execution RCE after authentication. Affected product:...