CVE-2025-47856

Two improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerabilities CWE-78 in Fortinet FortiVoice version 7.2.0, 7.0.0 through 7.0.6 and before 6.4.10 allows a privileged attacker to execute arbitrary code or commands via crafted HTTP/HTTPS or CLI requests...

CVE-2025-9976 OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x

An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine...

AndSoft e-TMS OS Command Injection Vulnerability (CNVD-2025-23544)

AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from an operating system command injection vulnerability that originates from a misuse of the parameter m in the file /clt/LOGINFRMCAT.ASP, which can be exploited by an attacker to execute operating system...

PT-2025-41776

Name of the Vulnerable Software and Affected Versions 3DEXPERIENCE versions R2022x through R2025x Description An OS Command Injection vulnerability exists in the Station Launcher App within the 3DEXPERIENCE platform. This issue could allow an attacker to execute arbitrary code on a user’s machine...

AndSoft e-TMS OS Command Injection Vulnerability (CNVD-2025-23540)

AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from an operating system command injection vulnerability that originates from a misuse of parameter m in file /clt/LOGINFRMDJO.ASP, which can be exploited by an attacker to execute operating system commands...

CVE-2016-15047

AVTECH devices that include the CloudSetup.cgi management endpoint are vulnerable to authenticated OS command injection. The exefile parameter in CloudSetup.cgi is passed to the underlying system command execution without proper validation or whitelisting. An authenticated attacker who can invoke...

CVE-2025-11491

CVE-2025-11491 affects wonderwhy-er DesktopCommanderMCP up to 0.2.13. The vulnerability is in CommandManager (src/command-manager.ts) where manipulation enables operating system command injection. Attacks can be initiated remotely, and public exploits exist. Connected sources do not provide a con...

PT-2025-41303

Name of the Vulnerable Software and Affected Versions wonderwhy-er DesktopCommanderMCP versions through 0.2.13 Description A flaw exists in the CommandManager function within the src/command-manager.ts file that allows for operating system command injection. This issue can be triggered remotely...

EUVD-2025-33285

An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter...

CVE-2025-57457

CVE-2025-57457 affects Curo UC300 (5.42.1.7.1.63R1). The Admin panel exposes an OS command injection via the IP Addr parameter, enabling local attackers to inject arbitrary OS commands. Root cause is unvalidated/unsanitized input in the IP Addr field. Impact is high: potential confidentiality, in...

PT-2025-41301

Name of the Vulnerable Software and Affected Versions Curo UC300 version 5.42.1.7.1.63R1 Description A flaw exists within the Admin panel that permits local attackers to inject arbitrary OS Commands. The injection occurs through the IP Addr parameter. Recommendations At the moment, there is no...

CVE-2025-36566

Dell PowerProtect Data Domain with Data Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an ...

CVE-2025-11407 D-Link DI-7001 MINI upgrade_filter.asp os command injection

A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgradefilter.asp. This manipulation of the argument path causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could b...

CVE-2025-36569

Dell PowerProtect Data Domain with Data Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an ...

CVE-2025-36569

Dell PowerProtect Data Domain with Data Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an ...

CVE-2025-36567

Dell PowerProtect Data Domain (DD OS) is affected by an OS Command Injection vulnerability due to improper neutralization of special elements in commands. A high-privilege local attacker could execute arbitrary commands and potentially escalate to root on DD OS Feature Release 7.7.1.0–8.1.0.10, L...

CVE-2025-43908

Dell PowerProtect Data Domain (DD OS) is affected by an OS Command Injection vulnerability in Feature Release 7.7.1.0–8.3.0.15, LTS2025 8.3.1.0, LTS2024 7.13.1.0–7.13.1.30, and LTS2023 7.10.1.0–7.10.1.60. The issue arises from improper neutralization of special elements in OS commands, potentiall...

CVE-2025-43911

Dell PowerProtect Data Domain with Data Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Neutralizatio...

CVE-2025-43890

Dell PowerProtect Data Domain with Data Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Neutralizatio...

CVE-2025-43911

Dell PowerProtect Data Domain (DD OS) feature releases and LTS lines are affected by an OS command injection vulnerability in multiple versions, caused by improper neutralization of special elements in OS commands. A high-privilege attacker with local access could achieve arbitrary command execut...