1408 matches found
CVE-2026-38820
openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...
PYSEC-2026-3776
opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the...
PYSEC-2026-3776
opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the...
CVE-2026-81698
opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the...
CVE-2026-81698 openssl_encrypt before 1.4.9 Shell Injection via info command
opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the...
CVE-2026-81698
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block . The root cause is that untrusted metadata fields (such as pepper_name) are interpolated without quoting, allowing an attacker to craft metadata values containing shell com...
CVE-2026-81698 openssl_encrypt before 1.4.9 Shell Injection via info command
opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the...
CVE-2026-81698 openssl_encrypt before 1.4.9 Shell Injection via info command
opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the...
CVE-2026-81698
opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the...
EUVD-2026-67054
opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the...
CVE-2026-57499 Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)
Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ipaddress parameter is embedded...
PT-2026-82599
Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description A shell injection issue exists in the info command's reconstructed CLI block. The system interpolates untrusted metadata fields without proper quoting, allowing attackers to craft metadata...
CVE-2026-81698: Improper Neutralization of Special Elements used in an OS Command
opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the...
AZL-98195 CVE-2026-79992 affecting package emacs for versions less than 29.4-6
A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitra...
CVE-2026-79992
CVE-2026-79992 affects Emacs TRAMP , where a local attacker can achieve arbitrary code execution by processing maliciously crafted filenames. The root cause is that TRAMP concatenates login arguments (derived from the user field) without proper sanitization before passing them to a local shell . ...
CVE-2026-63586 Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface
The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system function. By submitting a specially...
CVE-2026-63586
CVE-2026-63586 is a critical (CVSS 3.1: 9.8) unauthenticated remote code execution vulnerability in a web-based management interface that uses a modified uhttpd server with CGI shell scripts. The root cause is a shell injection flaw: the HTTP Basic Authentication username is taken directly from t...
CVE-2026-63586 Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface
The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system function. By submitting a specially...
Exploit for CVE-2026-16348
CVE-2026-16348 TP-Link Archer BE800 V1 — Authenticated RCE v...
EulerOS Virtualization 2.13.1 : samba (EulerOS-SA-2026-3197)
According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers tha...