CVE-2026-81476

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote...

CVE-2026-81476

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote...

EUVD-2026-81432

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote...

CVE-2026-81476

Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain an OS Command Injection vulnerability. An unauthenticated attacker with remote network access could potentially exploit this to achieve remote code execution , with high impact to confidentiality, integrity, and availability ...

Ashwesker-CVE-2025-64155

🔒 CVE-2025-64155: Critical FortiSIEM Vulnerability 📌 Overview CVE-2025-64155 is a critical security vulnerability in Fortinet FortiSIEM , a popular security information and event management platform. Publicly disclosed on January 13, 2026 , it allows unauthenticated remote attackers to execute...

CVE-2026-22553-InSAT-MasterSCADA-BUK-TS-MMadmServ

InSAT MasterSCADA BUK-TS - Unauthenticated RCE CVE-2026-22553 | CVSS 9.8 Critical | Exploit Author Mohammed Idrees Banyamer 📝 Description InSAT MasterSCADA BUK-TS suffers from an Unauthenticated OS Command Injection vulnerability in the MMadmServ web interface. This flaw allows remote attackers t...

ip-camera-research

IP Camera Research - Fullhan FH8626V100 AJL30PG0803 针对基于 Fullhan FH8626V100 SoC（型号 AJL30PG0803）的消费级 IP 摄像头进行的安全研究，共分配了六个 CVE，涵盖未认证 API 访问、明文凭据泄露以及通过操作系统命令注入实现完全未认证的设备接管。 完整报告：Breaking Into My Own IP Camera 设备概览...

CVE-2026-73570

CVE-2026-73570 — Zimbra ZCS SNMP Notification RCE exploit PoC Unauthenticated Remote Code Execution via OS Command Injection in the Zimbra Collaboration Suite SNMP notification handler. Overview Field| Value ---|--- CVE| CVE-2026-73570 CVSS 3.1| 8.9 HIGH — AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L CWE|...

CVE-2026-42167-PoC

CVE-2026-42167 POC ProFTPD 中通过 modsql SQL 注入实现预认证远程代码执行 作者： Van Glenndon Enad 原始发现： ZeroPath 发布时间： 2026年5月1日 严重性： 严重 CVSS v3.1 评分： 8.1 CVSS v3.1 向量： CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v2 评分： 7.6 CVSS v2 向量： CVSS2AV:N/AC:H/Au:N/C:C/I:C/A:C CWE： CWE-89（SQL注入），CWE-78（操作系统命令注入） 目录 1...

CVE-2026-34940

CVE-2026-34940 — OS Command Injection in KubeAI via Model URL in Ollama startup probe Severity : High CVSS 8.7 CWE : CWE-78 — Improper Neutralization of Special Elements used in an OS Command Affected : github.com/kubeai-project/kubeai = 0.23.1 Fixed in : 0.23.2 Advisory : GHSA-324q-cwx9-7crr NVD...

CVE-2025-57457

CURO UC300 IP电话中的操作系统命令注入 Curo UC300 5.42.1.7.1.63R1 管理面板中存在一个操作系统命令注入漏洞，允许本地攻击者通过“IP Addr”参数注入任意操作系统命令。 PoC: https://github.com/restdone/CVE-2025-57457/blob/main/oscommandinject.mp4 步骤 1. 登录 UC300 的管理面板（电话 IP 和端口 80） 2. 浏览至“网络”，然后选择“诊断” 3. 在“IP Addr”字段中注入操作系统命令 4. 点击“开始”并在电话上执行 Linux 命令 时间线...

CVE-2024-12856

CVE-2024-12856 Este es un exploit para los modelos de router Four-Faith F3x24 y F3x36 para obtener una reverse shell. "Los modelos de router Four-Faith F3x24 y F3x36 están afectados por una vulnerabilidad de inyección de comandos del sistema operativo SO. Al menos la versión de firmware 2.0 permi...

poc-yaws-cgi-shell-injection

OS command injection in Yaws web server CVE-2020-24916 Proof of concept Build test image: docker build -t vulnbe/yaws-pocs:shell-injection-appmod-cgi -f Dockerfile . and/or Run container docker run --rm -d -i -p 127.0.0.1:8000:8080 vulnbe/yaws-pocs:shell-injection-appmod-cgi root@kitploit: curl...

EUVD-2026-81280

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

CVE-2026-52483

CVE-2026-52483 affects the MitraStar GPT-2741GNAC-N2-SV router running firmware BR_g8.10_1.11(WVK.0)b46 . The ping diagnostics and similar functions are vulnerable to arbitrary OS command execution by authenticated users who send a crafted POST request to /cgi-bin/device-management-utilities-inte...

CVE-2026-92580

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

CVE-2026-92580 AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

CVE-2026-92398

A vulnerability was found in Ruijie RG-EW3000GX EW3.01B11P380. Affected by this issue is some unknown functionality of the file /etc/rgconfig/admin of the component userlistnote Module. Performing a manipulation of the argument Name results in os command injection. It is possible to initiate the...

CVE-2026-71179

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileg...

CVE-2026-92397

A vulnerability has been found in Ruijie RG-EW3000GX EW3.01B11P380. Affected by this vulnerability is the function ccset of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remote...