CVE-2026-75578

Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.execute, so the nested quotes terminate th...

EUVD-2026-125258

Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.execute, so the nested quotes terminate th...

CVE-2026-75578

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua. The root cause is the improper handling of the remote host token from uploaded OpenVPN configuration files; the application embeds a shellquote()-quoted token int...

CVE-2026-75578 Cudy TR3000 before 2.5.42 Command Injection via OpenVPN Client Configuration Upload

Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.execute, so the nested quotes terminate th...

PT-2026-146479

Name of the Vulnerable Software and Affected Versions Cudy TR3000 versions prior to 2.5.42 Description An OS command injection flaw exists where a malicious or compromised Auto Configuration Server ACS can execute commands with root privileges. This occurs when the set UserUsername function in...

PT-2026-146802

Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.execute, so the nested quotes terminate th...

CVE-2026-125757

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered b...

CVE-2020-37032: Improper Neutralization of Special Elements used in an OS Command

Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution through the...

PT-2026-5473

Name of the Vulnerable Software and Affected Versions Wing FTP Server version 6.3.8 Description The software contains a remote code execution issue in its Lua-based web console. Authenticated users can execute system commands by sending malicious commands via POST requests. The os.execute functio...

CVE-2025-34095: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute code, which is then persisted on...

Kong Gateway Admin API Remote Code Execution

This module uses the Kong admin API to create a route and a serverless function plugin that is associated with the route. The plugin runs Lua code and is used to run a system command using os.execute. After execution the route is deleted, which also deletes the plugin. Module Options msf use...

Wing FTP Server Authenticated Command Execution

This module exploits the embedded Lua interpreter in the admin web interface for versions 3.0.0 and above. When supplying a specially crafted HTTP POST request an attacker can use os.execute to execute arbitrary system commands on the target with SYSTEM privileges. Module Options msf use...

Setuid Nmap Exploit

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/post/common' require...