2649 matches found
Command Injection
@translated/lara-mcp is vulnerable to command injection. The vulnerability is due to unsanitized input passed to childprocess.exec, which allows an attacker to inject and execute arbitrary system commands through shell metacharacters...
Command Injection
Overview calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database. Affected versions of this package are vulnerable to Command Injection via the /admin/ajaxconfig endpoint that fails to properly neutralise special elements used in operating system commands...
CVE-2025-51482
Remote Code Execution in letta.server.restapi.routers.v1.tools.runtoolfromsource in letta-ai Letta 0.7.12 allows remote attackers to execute arbitrary Python code and system commands via crafted payloads to the /v1/tools/run endpoint, bypassing intended sandbox restrictions...
CVE-2025-53832
Lara Translate MCP Server is a Model Context Protocol MCP Server for Lara Translate API. Versions 0.0.11 and below contain a command injection vulnerability which exists in the @translated/lara-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to...
CVE-2025-41673
A high privileged remote attacker can execute arbitrary system commands via POST requests in the sendsms action due to improper neutralization of special elements used in an OS command...
CVE-2025-51482
Remote Code Execution in letta.server.restapi.routers.v1.tools.runtoolfromsource in letta-ai Letta 0.7.12 allows remote attackers to execute arbitrary Python code and system commands via crafted payloads to the /v1/tools/run endpoint, bypassing intended sandbox restrictions...
CVE-2025-41675
A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command...
CVE-2025-41674
A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command...
CVE-2025-41673
A high privileged remote attacker can execute arbitrary system commands via POST requests in the sendsms action due to improper neutralization of special elements used in an OS command...
CVE-2025-41674
The CVE-2025-41674 entry matches an OS command injection in MB CONNECT LINE mbNET.mini (industrial router) and Helmholz REX100/mbNET.mini family where improper neutralization of special elements in OS commands enables remote execution of commands via POST to a diagnostic action. Connected sources...
CVE-2025-41674 Remote Command Injection in diagnostic Action Due to Improper Input Neutralization
A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command...
PT-2025-30249 · Sendsms · Sendsms
Name of the Vulnerable Software and Affected Versions: versions prior to 2025-41673 Description: A high privileged remote attacker can execute arbitrary system commands via POST requests in the send sms action due to improper neutralization of special elements used in an OS command...
The vulnerability of the graphical interface of Git, a distributed version control system for software development by Microsoft Visual Studio, allows a hacker to execute arbitrary commands.
The vulnerability of the graphical interface of Git, a distributed version control system for software development by Microsoft Visual Studio, exists due to the failure to address the issues related to special elements used in operating system commands. Exploiting this vulnerability could allow a...
MB Connect Line mbNET.mini 操作系统命令注入漏洞
The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. MB CONNECT LINE mbNET.mini suffers from an operating system command injection vulnerability that stems from improper...
PT-2025-30250 · Librenms · Librenms
Name of the Vulnerable Software and Affected Versions: versions prior to 2.3 Description: A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command. Recommendations:...
Nokia WaveSuite NOC 安全漏洞
Nokia WaveSuite NOC is a unified operations and maintenance platform for optical networks from Nokia Finland. A security vulnerability exists in Nokia WaveSuite NOC that stems from a command that allows unfiltered user input to be passed to the underlying operating system for execution, potential...
PT-2025-30251 · Helmholz +1 · Rex100 +1
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralizati...
CVE-2025-54073
mcp-package-docs is an MCP Model Context Protocol server that provides LLMs with efficient access to package documentation across multiple programming languages and language server protocol LSP capabilities. A command injection vulnerability exists in the mcp-package-docs MCP Server prior to the...
Command Injection
@sunwood-ai-labs/github-kanban-mcp-server is vulnerable to command injection. The vulnerability is due to the use of the unsafe exec API with untrusted user input in the addcomment tool, which allows an attacker to execute arbitrary system commands through crafted input...
