Command injection.

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe_amazon.php

• guardian language-system
• Command injection

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate_text.php

• guardian language-system
• Command injection

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech_text.php

• guardian language-system
• Command injection

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.php

• guardian language-system
• Command injection

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php

• guardian language-system
• Command injection

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php

• guardian language-system
• Command injection

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php

• guardian language-system
• Command injection

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php

• guardian language-system
• Command injection

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate.php

• guardian language-system
• Command injection

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php

• guardian language-system
• Command injection

JAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC Endpoint

• JAIOTlink C492A-W6 Wi-Fi IP Camera
• Command injection

OS command injection in Seiko Solutions Inc. SkyBridge MB-A100/MB-A110

• Seiko Solutions Inc. SkyBridge MB-A100/MB-A110
• Command injection

An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set endpoint of Tenda AC18 v15.03.05.05 allows attackers to execute arbitrary commands via a crafted payload in…

• Command injection

OS Command Injection in StoneFly Storage Concentrator

• StoneFly Storage Concentrator
• StoneFly Storage Concentrator Virtual Machine
• Command injection

OS Command Injection in StoneFly Storage Concentrator

• Stonefly Storage Concentrator
• Stonefly Storage Concentrator Virtual Machine
• Command injection

Coolify: Authenticated RCE via command injection in CA certificate management feature

• coollabsio coolify
• Command injection

Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`

• coollabsio coolify
• Command injection

OS command injection in Gotcha Gotcha Games Inc. RPG MAKER MV and others

• Gotcha Gotcha Games Inc. RPG MAKER MV
• Gotcha Gotcha Games Inc. RPG MAKER MZ
• Command injection

OS command injection in AVTECH Security Corporation DGM3103SCT

• AVTECH Security Corporation DGM3103SCT
• Command injection

Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management

• coollabsio coolify
• Command injection

Coolify: Authenticated Host RCE

• coollabsio coolify
• Command injection

luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey

• openwrt luci-proto-openvpn
• Command injection

luci-app-tailscale-community - Command Injection via tailscale.do_login RPC

• openwrt luci-app-tailscale-community
• Command injection

Edimax EW-7478APC POST Request formStaDrvSetup os command injection

• Edimax EW-7478APC
• Command injection

Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension

• Red Hat OpenShift Dev Spaces 3.29
• Command injection

MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

• Command injection

<1.17.3 · fixed in 1.17.3

terminal-controller-mcp vulnerable to Command Injection

• Command injection

<=0.1.7 · no fixed version yet

utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

• Command injection

<1.1.2 · fixed in 1.1.2

PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection

• Command injection

<4.5.149 · fixed in 4.5.149

PraisonAI Vulnerable to OS Command Injection

• Command injection

<4.5.121 · fixed in 4.5.121

PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)

• Command injection

<1.5.128 · fixed in 1.5.128

Upsonic: remote code execution vulnerability in its MCP server/task creation functionality

• Command injection

<0.72.0 · fixed in 0.72.0

PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()

• Command injection

>=4.5.15, <4.5.69 · fixed in 4.5.69

pymetasploit3 vulnerable to command injection in console.run_module_with_output()

• Command injection

<=1.0.6 · no fixed version yet

PraisonAI has critical RCE via `type: job` workflow YAML

• Command injection
• Code injection

<4.5.139 · fixed in 4.5.139

Mlflow: Command Injection when serving models with enable_mlserver=True

• Command injection

<3.9.0 · fixed in 3.9.0

Remote Code Execution due to Full Controled File Write in mlflow

• Command injection

<2.9.2 · fixed in 2.9.2

Mocodo vulnerable to SQL injection in `/web/generate.php`

• Command injection

<4.2.7 · fixed in 4.2.7

llama-index-core Command Injection vulnerability

• Command injection

<0.10.24 · fixed in 0.10.24

Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool

• Command injection

<=0.5.9 · no fixed version yet

TkEasyGUI Vulnerable to OS Command Injection

• Command injection

<1.0.22 · fixed in 1.0.22

mcp-kubernetes-server has an OS Command Injection vulnerability

• Command injection

<=0.1.11 · no fixed version yet

Edimax EW-7478APC POST Request formiNICbasic os command injection

• Edimax EW-7478APC
• Command injection

Edimax EW-7478APC POST Request formAccept os command injection

• Edimax EW-7478APC
• Command injection

D-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection

• D-Link DCS-935L
• Command injection

Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection

• Wavlink WL-NU516U1-A
• Other injection
• Command injection

antlr ANTLR4 gofmt GoTarget.java GoTarget command injection

• ANTLR4
• Other injection
• Command injection

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

• Command injection
• CWE-494

<10.34.2 || >=11.0.0, <11.5.3 · fixed in 10.34.2, 11.5.3

H.VIEW HV-500S6 IP Camera OS Command Injection

• H.VIEW HV-500S6 IP Camera
• Command injection

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

• Command injection

<10.34.0 || >=11.0.0, <11.4.0 · fixed in 10.34.0, 11.4.0

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

• Command injection

<2.5.1 · fixed in 2.5.1

Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

• kestra
• Command injection
• Authentication bypass

Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter

• notepad-plus-plus
• Command injection

Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection

• notepad-plus-plus
• Command injection

Cudy LT300 3.0 OS Command Injection via NTP Configuration

• Shenzhen Cudy Technology Co., Ltd. LT300 3.0
• Command injection

@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths

• Command injection

<12.4.3 · fixed in 12.4.3

Dokku: OS Command Injection via app.json managed Cron

• dokku
• Command injection

Dokku: OS Command Injection via App Name in Git Pre-Receive Hook

• dokku
• Command injection

OS command injection in Dell Container Storage Modules

• Dell Container Storage Modules
• Command injection

Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP

• Command injection

>=2.2.7-patch.1, <3.0.6 · fixed in 3.0.6