Command injection.

A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7.

• Command injection

Dokploy has Command Injection in its Service Operations

• dokploy
• Command injection

ngrok is Vulnerable to Command Injection

• Command injection

=4.3.3 || =5.0.0-beta.2 · no fixed version yet

Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter

• Command injection

<=1.18.1 · no fixed version yet

Edimax BR-6428NS POST Request formStaDrvSetup command injection

• Edimax BR-6428NS
• Other injection
• Command injection

Edimax BR-6228NC POST Request mp command injection

• Edimax BR-6228NC
• Other injection
• Command injection

linlinjava litemall Database Setting DbUtil.java load argument injection

• linlinjava litemall
• Other injection
• Command injection

vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection

• vercel ai
• Command injection

kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection

• kalcaddle Kodbox
• Other injection
• Command injection

AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

• Command injection

<=29.0 · no fixed version yet

Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh

• Eugeny tabby
• Command injection

Tabby: RCE via `tabby://run` URL Scheme

• Eugeny tabby
• Command injection

Turborepo: VSCode Extension command injection

• vercel turborepo
• Command injection

Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag

• vim
• Command injection

Remote Code Execution in PDF Export Module

• DHTMLX PDF Export Module
• Command injection

OS command injection in Delphix Continuous data IBM Db2 Connector and others

• Delphix Continuous data IBM Db2 Connector
• Delphix Continuous data MangoDB Connector
• Command injection

Oinone Pamirs 7.0.0 contains a command injection vulnerability in CommandHelper.executeCommands.

• Command injection

HRConvert2: Missing Sanitization enables Unauthenticated Remote Command Execution

• zelon88 HRConvert2
• Command injection

mdserver-web: Missing Authorization and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

• midoks mdserver-web
• Command injection
• Broken access control

dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

• Command injection

<1.17.1 · fixed in 1.17.1

n8n Has an Arbitrary File Read via Git Node

• Command injection

<1.123.43 || >=2.0.0-rc.0, <2.20.7 || >=2.21.0, <2.22.1 · fixed in 1.123.43, 2.20.7, 2.22.1

@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input

• Command injection

<=3.6.0 · no fixed version yet

Flowise has an MCP Security Bypass that Enables RCE

• Command injection
• CWE-184

<3.1.2 · fixed in 3.1.2

Fleet vulnerable to OS command injection in software packages

• Command injection

<4.81.1 · fixed in 4.81.1

Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection.

• Command injection

Web::Passwd versions through 0.03 for Perl is vulnerable to RCE

• EVANK Web::Passwd
• Command injection

OPNsense: Command Injection via Attacker-Controlled DHCP Config

• opnsense core
• Command injection

OPNsense: RCE on user managment

• opnsense core
• Command injection

OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method

• opnsense core
• Command injection

PAN-OS: Authenticated Admin Command Injection Vulnerability

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks PAN-OS
• Command injection

uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution

• Command injection

<0.27.1 · fixed in 0.27.1

claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh

• Command injection
• Code injection

>=3.5.0, <3.5.2 · fixed in 3.5.2

Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

• Command injection

>=4.17.0, <5.31.6 · fixed in 5.31.6

OS command injection in Lenovo Personal Cloud T2s and others

• Lenovo Personal Cloud T2s
• Lenovo Personal Cloud T2Pro
• Command injection

Knowledge Appliance mode iControl REST vulnerability

• F5 BIG-IP
• Command injection

BIG-IP Privilege Escalation vulnerability

• F5 BIG-IP
• Command injection

iControl REST and TMSH vulnerability

• F5 BIG-IP
• F5 BIG-IQ
• Command injection

BIG-IP iControl SOAP vulnerability

• F5 BIG-IP
• Command injection

iControl REST and tmsh vulnerability

• F5 BIG-IP
• Command injection

OS command injection in ELECOM CO.,LTD. WRC-BE72XSD-B and others

• ELECOM CO.,LTD. WRC-BE72XSD-B
• ELECOM CO.,LTD. WRC-BE72XSD-BA
• Command injection

OS command injection in ELECOM CO.,LTD. WRC-BE72XSD-B and others

• ELECOM CO.,LTD. WRC-BE72XSD-B
• ELECOM CO.,LTD. WRC-BE72XSD-BA
• Command injection

U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Command Injection.

• Command injection

OS command injection in Claris FileMaker Cloud

• Claris FileMaker Cloud
• Command injection

efw4.X: RCE via zipslip

• efwGrp efw4.X
• Command injection

Authenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating Systems

• Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
• Command injection

efw4.X: Path Traversal via Unchecked dst Parameter leads to Remote Code Execution

• efwGrp efw4.X
• Command injection

Authenticated Arbitrary File Upload via Command Injection in AOS-8 AND AOS-10 Web-Based Management Interface

• Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
• Command injection

Authenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating Systems

• Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
• Command injection

Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10

• Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
• Command injection

Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10

• Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
• Command injection

Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10

• Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
• Command injection

Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10

• Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
• Command injection

Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10

• Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
• Command injection

Authenticated Remote Code Execution via Arbitrary File Write in AOS-8 and AOS-10 Web-Based Management Interface

• Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
• Command injection

Authenticated Remote Code Execution via Arbitrary File Write in AOS-8 and AOS-10 Web-Based Management Interface

• Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
• Command injection

Authenticated Command Injection leads to RCE in AOS-10 CLI Command

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Command injection

Ops Manager RCE via webhook body

• MongoDB, Inc. Ops Manager
• Command injection

Inconsistent input filtering allows Authenticated Command Injection in AOS-10 CLI

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Command injection

Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Command injection

Microsoft Outlook for iOS Tampering Vulnerability

• Microsoft Outlook for iOS
• Command injection