CVE-2023-30854

WWBN Avideo 认证 RCE - 操作系统命令注入 CVE-2023-30854 WWBN Avideo sqlFile $objClone-cloneSiteURLvideos/cache/clones/$json-sqlFile"; $log-add"Clone 2 of $totalSteps: Geting MySQL Dump file"; exec$cmd . " 2&1", $output, $returnval; 我们可以通过管理面板的克隆站点功能控制 $objClone-cloneSiteURL。...

blogpost_cve-2018-19987-analysis

Análisis de CVE-2018-19987 inyección de comandos del sistema operativo en D-Link ¡Hola a todos! En esta breve entrada de blog desglosaré un análisis rápido que realicé para comprender mejor los detalles detrás de CVE-2018-19987. Al principio fui tras este CVE porque pensé que no había información...

CVE-2026-91140

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...

CVE-2026-85523

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1...

CVE-2026-34498

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

CVE-2026-105841

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

cve-2017-12945

CVE-2017-12945 CVE-2017-12945 利用 Mersive Solstice Pods（由 Mersive Technologies Inc. 设计的无线协作和演示平台）在运行早于 2.8.4 版本的固件时，存在一个（远程）（经过身份验证的）（盲注）操作系统命令注入漏洞，正如供应商网站上所承认/报告的那样（见下方截图）。因此，经过身份验证的攻击者可以通过发送特制的 HTTP 请求，在存在漏洞的 Mersive Solstice Pods 上以 root 权限执行任意命令。 此漏洞的存在是由于服务端对输入/参数缺乏验证。一些用户控制的输入/参数被直接传递给 publi...

CVE-2024-53376

CVE-2024-53376 CyberPanel 已认证操作系统命令注入 受影响版本 CyberPanel 版本 2.3.8 存在操作系统命令注入漏洞。利用该漏洞，攻击者需首先登录 Web 面板。 测试环境 CyberPanel 2.3.7 技术细节 攻击者可以使用 HTTP OPTIONS 请求，指示运行 CyberPanel 应用的 Web 服务器执行任意命令。该漏洞位于 /websites/submitWebsiteCreation 端点。 该端点调用了 /websiteFunctions/views.py 文件中的 submitWebsiteCreation 函数。...

EUVD-2026-93399

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1...

CVE-2026-85523 OS Command Injection in Felisify Informatics' SambaBox

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1...

CVE-2026-85523

SambaBox by Felisify Information Technologies Industry and Trade Inc. is vulnerable to OS Command Injection due to the improper neutralization of special elements used in an OS command (CWE-78 ). This issue affects versions before 5.4.1 . An attacker could potentially execute arbitrary commands o...

CVE-2026-34498 L4L

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

CVE-2026-34498

An improper input validation vulnerability exists in Johnson Controls Illustra Standard - L4L China on Windows platforms. This flaw allows for OS Command Injection , specifically affecting versions before 6.0.0.66394 . The documents do not provide specific technical details regarding the vulnerab...

EUVD-2026-93398

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

CVE-2026-91140 OS command injection in Progress Software Autonomous REST Connector GenAI Agents

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...

EUVD-2026-93397

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...

CVE-2026-91140 OS command injection in Progress Software Autonomous REST Connector GenAI Agents

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...

CVE-2026-91140

The Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 contains an OS command injection vulnerability (CWE-78) within its shell-based temporary-file cleanup instructions. An attacker can execute arbitrary commands on a developer's machine by providing a crafte...

CVE-2026-105841 lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

CVE-2026-105841

The lrzsz utility, in versions before 0.13.0 , is vulnerable to an OS command injection in the lrz receive utility's pipe mode. The root cause is located in src/lrz.c, where the procheader() function passes unescaped ZMODEM/YMODEM filenames to popen() when running under a suffixed name like lrzta...