Command injection.

Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click

• Command injection
• Open redirect

<=3.8.15 · no fixed version yet

DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgi

• DrayTek Vigor 2960
• Command injection

Command injection in Dashboard Server interface

• Universal Robots PolyScope 5
• Command injection

An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209.

• Command injection

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on the server via a crafted build parameter.

• Command injection

/cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a POST request that carries a serverName parameter.

• Command injection

In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.

• Command injection

Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field.

• Command injection

8421bit MiniClaw kernel.ts executeCognitivePulse os command injection

• 8421bit MiniClaw
• Command injection

Azure Cloud Shell Spoofing Vulnerability

• Microsoft Azure Cloud Shell
• Command injection

Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability

• Copilot Chat (Microsoft Edge)
• Command injection

node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js

• Command injection

=1.0.15 · no fixed version yet

OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23/24/26/28

• Hitachi Virtual Storage Platform One Block 23
• Hitachi Virtual Storage Platform One Block 24
• Command injection

Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure

• Command injection

>=1.47.0, <1.103.0 · fixed in 1.103.0

Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection

• Command injection

=8.29.1 · no fixed version yet

Cisco IoT Field Network Director Command Injection Vulnerability

• Cisco IoT Field Network Director (IoT-FND)
• Command injection

HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability

• HCL BigFix RunBookAI
• Command injection
• CWE-351

Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass

• Command injection
• Insecure deserialization

<2.0.0-beta.2 · fixed in 2.0.0-beta.2

@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts

• Command injection

<1.70.0-beta.5 · fixed in 1.70.0-beta.5

JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request

• Command injection
• CWE-20

>=4.0.0, <4.5.7 · fixed in 4.5.7

exiftool-vendored vulnerable to argument injection via newline characters in tag names

• Command injection

<35.19.0 · fixed in 35.19.0

gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules

• Command injection
• CWE-183

>=0.31.0, <0.83.0 · fixed in 0.83.0

LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution

• Command injection
• Cross-site scripting (XSS)

<=2.1.26 · no fixed version yet

Hidden Console Command

• Crestron Electronics Touchpanels (x60/x70)
• Command injection

EFM ipTIME C200 ApplyRestore Endpoint iux_set.cgi sub_408F90 command injection

• EFM ipTIME C200
• Other injection
• Command injection

Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injection

• Totolink A8000RU
• Command injection

54yyyu code-mcp MCP Tool server.py git_operation command injection

• 54yyyu code-mcp
• Other injection
• Command injection

The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /action/SetRemoteAccessCfg endpoint.

• Command injection
• Authentication bypass

OS command injection vulnerability in the traceroute diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router with firmware 3GN8020801R13, 3GN8020802R0A, or 3GN802…

• Command injection

OS command injection vulnerability in the ping diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router with firmware 3GN8020801R13, 3GN8020802R0A, or 3GN8020803R0…

• Command injection

A-G-U-P-T-A wireshark-mcp pyshark_mcp.py quick_capture os command injection

• A-G-U-P-T-A wireshark-mcp
• Command injection

net-imap vulnerable to command Injection via "raw" arguments to multiple commands

• Command injection
• Other injection

<0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4 · fixed in 0.4.24, 0.5.14, 0.6.4

net-imap vulnerable to command Injection via unvalidated Symbol inputs

• Command injection
• Other injection

<0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4 · fixed in 0.4.24, 0.5.14, 0.6.4

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

• Command injection

<=0.8.6rc0 · no fixed version yet

WDR201A WiFi Extender OS Command Injection via firewall.cgi

• Shenzhen Yipu Commercial and Trading Co., Ltd WDR201A WiFi Extender
• Command injection

WDR201A WiFi Extender OS Command Injection via adm.cgi (reboot_time)

• Shenzhen Yipu Commercial and Trading Co., Ltd WDR201A WiFi Extender
• Command injection

WDR201A WiFi Extender OS Command Injection via makeRequest.cgi

• Shenzhen Yipu Commercial and Trading Co., Ltd WDR201A WiFi Extender
• Command injection

WDR201A WiFi Extender OS Command Injection via internet.cgi

• Shenzhen Yipu Commercial and Trading Co., Ltd WDR201A WiFi Extender
• Command injection

WDR201A WiFi Extender OS Command Injection via wireless.cgi

• Shenzhen Yipu Commercial and Trading Co., Ltd WDR201A WiFi Extender
• Command injection

Shell command injection in 3onedata GW1101-1D(RS-485)-TB-P modbus gateway

• 3onedata GW1101-1D(RS-485)-TB-P
• Command injection

Prefect Git Argument Injection in GitRepository Pull Steps

• Other injection
• Command injection

<3.6.25.dev7 · fixed in 3.6.25.dev7

privsim mcp-test-runner MCP index.ts child_process.spawn os command injection

• privsim mcp-test-runner
• Command injection

Totolink WA300 cstecgi.cgi NTPSyncWithHost command injection

• Totolink WA300
• Other injection
• Command injection

Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injection

• Totolink WA300
• Other injection
• Command injection

Totolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injection

• Totolink WA300
• Other injection
• Command injection

GeoVision LPC2011/LPC2211 Web Interface / DdnsSetting.cgi OS command injection vulnerability

• GeoVision Inc. GV-LPC2011/LPC2211
• Command injection

An issue in Lymphatus caesium-image-compressor All versions up to and including commit 02da2c6 allows a local attacker to execute arbitrary code via the shutdownMachine and putMachineToSleep function…

• Command injection
• Code injection

JD Cloud JDCOS Service jdcap set_iptv_info command injection

• JD Cloud JDCOS
• Other injection
• Command injection

Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injection

• Tiandy Easy7 Integrated Management Platform
• Command injection

Wavlink WL-WN570HA1 adm.cgi ping_ddns command injection

• Wavlink WL-WN570HA1
• Other injection
• Command injection

Wavlink WL-WN570HA1 adm.cgi set_sys_cmd command injection

• Wavlink WL-WN570HA1
• Other injection
• Command injection

Wavlink WL-WN570HA1 adm.cgi set_sys_adm command injection

• Wavlink WL-WN570HA1
• Other injection
• Command injection

langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injection

• langflow
• Other injection
• Command injection

Edimax BR-6428nC Web setWAN command injection

• Edimax BR-6428nC
• Other injection
• Command injection

Edimax BR-6208AC L2TP Mode setWAN command injection

• Edimax BR-6208AC
• Other injection
• Command injection

r-huijts mcp-server-rijksmuseum MCP index.ts open_image_in_browser os command injection

• r-huijts mcp-server-rijksmuseum
• Command injection

pskill9 website-downloader MCP index.ts download_website os command injection

• pskill9 website-downloader
• Command injection

kleneway awesome-cursor-mpc-server Ccode-Review Tool codeReview.ts runCodeReviewTool command injection

• kleneway awesome-cursor-mpc-server
• Other injection
• Command injection

crazyrabbitLTC mcp-code-review-server RepoMix repomix.ts executeRepomix command injection

• crazyrabbitLTC mcp-code-review-server
• Other injection
• Command injection

TRENDnet TEW-821DAP Firmware Udpate diagnostic tools_diagnostic os command injection

• TRENDnet TEW-821DAP
• Command injection