Command injection.

OpenWrt luci-app-dockerman Read ACL Remote Code Execution

• openwrt luci
• Command injection

GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injection

• GL.iNet GL-MT3000
• Other injection
• Command injection

GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection

• GL.iNet GL-MT3000
• Other injection
• Command injection

GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command injection

• GL.iNet GL-MT3000
• Other injection
• Command injection

GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get_system_log command injection

• GL.iNet GL-MT3000
• Other injection
• Command injection

Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection

• Wavlink WL-NU516U1
• Command injection

Wavlink WL-NU516U1 Config Import os command injection

• Wavlink WL-NU516U1
• Command injection

An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters.

• Command injection

The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true.

• Command injection

Duplicate Advisory: GitPython unsafe clone option gate bypass through joined short options

• Command injection

=3.1.50 · no fixed version yet

Duplicate Advisory: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

• Command injection

<=3.1.50 · no fixed version yet

Duplicate Advisory: GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

• Command injection

<=3.1.50 · no fixed version yet

GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes a...

• Command injection

>=3.1.50, <3.1.51 · fixed in 3.1.51

Wazuh GitHub Actions Shell Injection via Fork Pull Request

• wazuh
• Command injection

Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75

• TP-Link Systems Inc. AXE75 V1
• Command injection

pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

• pgadmin.org pgAdmin 4
• Command injection
• CWE-115

pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

• pgadmin.org pgAdmin 4
• Command injection

OS command injection in Hikvision DS-3WAP521-SI and others

• Hikvision DS-3WAP521-SI
• Hikvision DS-3WAP522-SI
• Command injection

Command injection in Advantech ADAM-3600

• Advantech ADAM-3600
• Command injection

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection

• RedHatInsights yggdrasil-worker-package-manager
• Red Hat Enterprise Linux 10
• Command injection

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulner…

• Command injection

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulner…

• Command injection

TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface.

• Command injection

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulner…

• Command injection

This Power Hardware Management Console update is being released to address

• IBM HMC V10.3.1050.0
• IBM HMC V11.1.1110.0
• Command injection

Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints

• IBM Langflow OSS
• Command injection

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

• Command injection

>=0.0.0-20251025234746-ef5a67e7b8ea, <0.0.0-20260708084548-995ff79736f2 · fixed in 0.0.0-20260708084548-995ff79736f2

IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

• IBM App Connect Enterprise
• Command injection

OS command injection in Eaton PADM

• Eaton PADM
• Command injection

OS command injection in Eaton PADM

• Eaton PADM
• Command injection

Command Injection in SCM (idledisconnect parameter)

• Phoenix Contact CHARX SEC-3150
• Phoenix Contact CHARX SEC-3100
• Command injection

Local Privilege Escalation vulnerability in /etc/init.d/user-applications via customer website file

• Phoenix Contact CHARX SEC-3150
• Phoenix Contact CHARX SEC-3100
• Command injection

Local Privilege Escalation via pppd password injection

• Phoenix Contact CHARX SEC-3150
• Phoenix Contact CHARX SEC-3100
• Command injection

OS Command Injection in OCPP Agent via charge_box_id

• Phoenix Contact CHARX SEC-3150
• Phoenix Contact CHARX SEC-3100
• Command injection

udhcpc Privilege Escalation

• Phoenix Contact CHARX SEC-3150
• Phoenix Contact CHARX SEC-3100
• Command injection

Local Privilege Escalation via Network scripts

• Phoenix Contact CHARX SEC-3150
• Phoenix Contact CHARX SEC-3100
• Command injection

Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script

• Phoenix Contact CHARX SEC-3150
• Phoenix Contact CHARX SEC-3100
• Command injection

Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Command injection

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulner…

• Command injection

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file

• Command injection

Logging operator has Fluentd configuration injection that allows remote code execution

• Other injection
• Command injection

<0.0.0-20260608145523-cf437d7f1e05 · fixed in 0.0.0-20260608145523-cf437d7f1e05

Arbitrary Command Execution in GNU Bison

• GNU Bison
• Command injection

OS command injection in IBM Aspera Faspex

• IBM Aspera Faspex 5
• Command injection

OS Command Injection in IBM Aspera Faspex

• IBM Aspera Faspex 5
• Command injection

OS command injection in ELECOM CO.,LTD. WAB-M1775-PS and others

• ELECOM CO.,LTD. WAB-M1775-PS
• ELECOM CO.,LTD. WAB-S1775
• Command injection

OS command injection in ELECOM CO.,LTD. WRC-X3000GS3-B and others

• ELECOM CO.,LTD. WRC-X3000GS3-B
• ELECOM CO.,LTD. WRC-X3000GS3A-B
• Command injection

Argument injection in Apple macOS

• Apple macOS
• Command injection

OS command injection in NVIDIA NeMo Framework

• NVIDIA NeMo Framework
• Command injection

VeloCloud Orchestrator OS Command Injection

• Arista Networks VeloCloud Orchestrator On-Prem
• Command injection

Improper Neutralization of Special Elements used in an OS Command Vulnerability

• Ericsson Packet Core Controller (PCC)
• Command injection

Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality

• Progress Software LoadMaster
• Progress Software ECS Connection Manager
• Command injection

Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface

• Progress Software LoadMaster
• Progress Software ECS Connection Manager
• Command injection

Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface

• Progress Software LoadMaster
• Progress Software ECS Connection Manager
• Command injection

NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python

• codexu NoteGen
• Command injection
• Broken access control

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options

• RRWO Catalyst::View::Wkhtmltopdf
• Command injection

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

• Command injection

<1.18.1 · fixed in 1.18.1

Shescape: Shell injection via unescaped parentheses on Windows with CMD

• Command injection
• CWE-150

<2.1.14 || >=3.0.0, <3.0.1 · fixed in 2.1.14, 3.0.1

Shescape: Path disclosure on Unix with Zsh

• Command injection
• CWE-155

<2.1.14 || >=3.0.0, <3.0.1 · fixed in 2.1.14, 3.0.1

Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

• Command injection

<2.0.7 · fixed in 2.0.7

Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

• Path traversal
• Command injection

>=2.1.38, <2.1.163 · fixed in 2.1.163