📄 NCR Command Center Agent 16.3 Remote Code Execution

CMCAgent in NCR Command Center Agent version 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021...

Malicious code in mcp-runcommand-server2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 36fb61d44529c380f204d5a210017989695ef39df6adfce7ccfb08e48a17b594 Package starts a reverse shell to a hardcoded location --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2025-191648 Malicious code in mcp-runcommand-server2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 36fb61d44529c380f204d5a210017989695ef39df6adfce7ccfb08e48a17b594 Package starts a reverse shell to a hardcoded location --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in mcp-runcommand-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 17f8adb9e7e30e13f8656300881d4e04975f499c03c2f1dbea2e00fd86c357a5 Package starts a reverse shell to a hardcoded location --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2025-191647 Malicious code in mcp-runcommand-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 17f8adb9e7e30e13f8656300881d4e04975f499c03c2f1dbea2e00fd86c357a5 Package starts a reverse shell to a hardcoded location --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

EUVD-2025-27771

Malicious code in bioql PyPI...

EUVD-2025-29491

Malicious code in bioql PyPI...

Malware in @lanyer640/mcp-runcommand-server

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @lanyer640/mcp-runcommand-server (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 579dd9f67fcc75d122b101f5772fefa4c424495f6d36aac46c51baf3e0263ea7 Any computer that has this package installed or running should be considered...

Remote Code Execution (RCE)

picklescan is vulnerable to Remote Code Execution RCE. The vulnerability is due to unsafe execution/deserialization due to runcommand executing untrusted input e.g., data from malicious pickle files or injected code in the interpreter context, allowing arbitrary code execution...

CGM CLININET Code Injection Vulnerability (CNVD-2025-19812)

CGM CLININET is a hospital information management system from CGM Germany. CGM CLININET suffers from a code injection vulnerability that stems from the RunCommand function failing to properly filter the special elements of the constructor code segment. An attacker can exploit this vulnerability t...

CVE-2025-30056

The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system...

CVE-2025-30056 Calling system commands via RunCommand

The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system...

CVE-2025-30056: Improper Control of Generation of Code

The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system...

PT-2025-34851 · Unknown · Runcommand

Name of the Vulnerable Software and Affected Versions: versions prior to 2025-30056 Description: The RunCommand function accepts any parameter, which is then passed for execution in the shell, allowing an attacker to execute arbitrary code on the system. Recommendations: At the moment, there is n...

Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand

Summary Using idlelib.pyshell.ModifiedInterpreter.runcommand function, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to...

Command Injection

p4 is vulnerable to command injection. The vulnerability exists due to improper input sanitization in the runCommand function, which allows an attacker to inject maliciously crafted commands into the system...

CVE-2022-29496

A stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality of Blynk -Library v1.0.1. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability...

PT-2022-19659

Name of the Vulnerable Software and Affected Versions Blynk -Library version 1.0.1 Description A stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality. This issue can be triggered by a specially-crafted network request, potentially leading to command...

CVE-2022-29496: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality of Blynk -Library v1.0.1. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability...