Pheditor 2.0.1-2.0.3 - OS Command Injection

Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges. id: CVE-2026-48030 info: name: Pheditor 2.0.1-2.0.3 - OS...

CVE-2026-14802

CVE-2026-14802 Nome del software vulnerabile e versioni interessate create-react-app versioni precedenti alla 5.0.2 Descrizione Su macOS, la funzione startBrowserProcess all'interno del file openBrowser.js del componente react-dev-utils consente l'iniezione di comandi del sistema operativo. Quest...

NetMRI-2014-3418

NetMRI-CVE-2014-3418 - Modulo Metasploit Modulo Metasploit per InfoBlox Network Automation: iniezione di comandi del sistema operativo Prodotto: Network Automation root@kitploit: NetMRI Switch Port Manager Automation Change Manager Security Device Controller Fornitore: root@kitploit: InfoBlox...

CVE-2024-56115

CVE-2024-56115 Descrizione suggerita Esiste una vulnerabilità in Amiro.CMS prima della versione 7.8.4 a causa della mancata adozione di misure per neutralizzare elementi speciali. Consente a un attaccante remoto di condurre un attacco Cross-Site Scripting XSS. Tipo di vulnerabilità CWE-78 |...

CVE-2025-26056

CVE-2025-26056 Autor: Rohan Deshpande OS-Befehlsinjektion Zusammenfassung Die Befehlsinjektion im Betriebssystem ist eine Sicherheitslücke, die es einem Angreifer ermöglicht, über eine angreifbare Anwendung beliebige Befehle auf einem Host-Betriebssystem auszuführen. Dies kann zu unbefugtem...

CVE-2026-48030

CVE-2026-48030 — Injeção de Comando de SO no Pheditor Visão Geral...

CVE-2026-22553-InSAT-MasterSCADA-BUK-TS-MMadmServ

InSAT MasterSCADA BUK-TS - RCE non autenticata CVE-2026-22553 | CVSS 9.8 Critico | Autore dell'exploit: Mohammed Idrees Banyamer 📝 Descrizione InSAT MasterSCADA BUK-TS soffre di una vulnerabilità di OS Command Injection non autenticata nell'interfaccia web MMadmServ. Questa falla consente a un...

CVE-2026-78685

CVE-2026-78685 affects the Le-yan Medical Practice Management System , a web-based application for managing medical practices. The vulnerability is a Remote Code Execution (RCE) flaw that allows unauthenticated remote attackers to execute arbitrary OS commands by serving a crafted HTML page that ...

blogpost_cve-2018-19987-analysis

CVE-2018-19987 D-Link OS command injection – Analyse Hallo zusammen! In diesem kurzen Blogbeitrag stelle ich eine schnelle Analyse vor, die ich durchgeführt habe, um die Details hinter CVE-2018-19987 besser zu verstehen. Zunächst bin ich dieser CVE nachgegangen, weil ich dachte, dass es keine...

CVE-2025-69212-PoC

CVE-2025-69212 - OpenSTAManager PoC di iniezione di comandi del sistema operativo Utilizzo Installa le dipendenze: root@kitploit: pip install -r requirements.txt Esegui un singolo comando e stampa il suo output: root@kitploit: python3 cve-2025-69212poc.py -u http://target.com -U admin -P 'passwor...

PT-2026-81457

Name of the Vulnerable Software and Affected Versions Adobe Campaign Classic affected versions not specified Description An Improper Neutralization of Special Elements used in an OS Command occurs, leading to an OS Command Injection. This allows an attacker to execute arbitrary code in the contex...

CVE-2026-28672

CVE-2026-28672 — Iniezione di comandi OS in UnixUserGroupBuilder di Apache Ranger Reproducer proof-of-concept eseguibile per l'iniezione di comandi OS nel modulo user-sync unixusersync di Apache Ranger. Durante l'enumerazione dei gruppi di ogni utente sincronizzato, UnixUserGroupBuilder esegue il...

CVE-2026-78430

CVE-2026-78430 is an OS command injection vulnerability in sworddut mcp-ffmpeg-helper versions 0.1.0, 0.1.1, and 0.2.1. The flaw resides in the handleToolCall function within the Tool Handler component (file src/tools/handlers.ts), where improper manipulation of the format argument allows command...

EUVD-2026-65092

A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall of the file src/tools/handlers.ts of the component Tool Handler. The manipulation of the argument format results in os command injection. Attacking locally is a requirement. The...

CVE-2023-36143

CVE-2023-36143 Der Maxprint Maxlink 1200G v3.4.11E weist eine Schwachstelle zur OS-Befehlseinschleusung in der Funktionalität des "Diagnostic tool" des Geräts auf...

CVE-2025-69212-PoC

CVE-2025-69212 OpenSTAManager = 2.9.8 — Iniezione di Comandi OS nell'Elaborazione di File P7M Panoramica...

EUVD-2026-65008

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backendconfig property in backend/src/Entity/Station.php is annotated with GROUPGENERAL, and PUT /api/station/stationid/profile/edit in...

EUVD-2026-65006

An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute th...

CVE-2026-71929 DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to...

CVE-2026-71927 DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execut...