Command injection.

Shell Command Injection in nnn

• nnn
• Command injection

Shell Command Injection in nnn

• nnn
• Command injection

TRENDnet Router ping.cgi command injection

• TRENDnet Router
• Other injection
• Command injection

TRENDnet TEW-823DRU admin.cgi command injection

• TRENDnet TEW-823DRU
• Other injection
• Command injection

Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback

• truelockmc streambert
• Command injection
• CWE-20

LibreNMS Vulnerable to Remote Code Execution via AboutController

• Command injection

<26.5.0 · fixed in 26.5.0

Blueprint Studio Git credential helper command injection

• ha-china blueprint-studio
• Command injection

MONAI vulnerable to OS command injection

• Command injection

<1.6.0 · fixed in 1.6.0

Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist

• super-productivity
• Command injection

LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module

• Command injection

>=21.6.0, <26.5.0 · fixed in 26.5.0

Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual)

• pyenv
• Command injection
• CWE-155

Microsoft Copilot Information Disclosure Vulnerability

• Microsoft Copilot Web
• Command injection

COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection

• COMFAST CF-N1-S
• Command injection

Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution

• notepad-plus-plus
• Command injection
• CWE-345

Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• Command injection

kylecui NetForensicMCP index.js execAsync command injection

• kylecui NetForensicMCP
• Other injection
• Command injection

uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

• Command injection
• Weak cryptography or TLS

>=0.27.4, <0.28.9 · fixed in 0.28.9

uniget CLI has an EDITOR Command Injection

• Command injection

<0.27.6 · fixed in 0.27.6

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

• Command injection

<4.5.6 · fixed in 4.5.6

Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

• Command injection

>=4.5.2, <4.5.6 · fixed in 4.5.6

Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

• Command injection

<4.5.6 · fixed in 4.5.6

OS command injection in JetBrains IntelliJ IDEA

• JetBrains IntelliJ IDEA
• Command injection

Command injection in JetBrains IntelliJ IDEA

• JetBrains IntelliJ IDEA
• Command injection

User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests

• openshift-metal3 fakefish
• Command injection

OS command injection in Dell ObjectScale

• Dell ObjectScale
• Command injection

OS command injection in Dell ObjectScale

• Dell ObjectScale
• Command injection

OS command injection in Dell ObjectScale

• Dell ObjectScale
• Command injection

Command injection in Roundcube Webmail

• Roundcube Webmail
• Command injection

Command injection in Roundcube Webmail

• Roundcube Webmail
• Command injection

Command injection in Roundcube Webmail

• Roundcube Webmail
• Command injection

OS command injection in Roundcube Webmail

• Roundcube Webmail
• Command injection

SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe

• siyuan
• Command injection

GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection

• GL.iNet A1300
• GL.iNet AX1800
• Command injection

GL.iNet BE9300/MT6000 Firewall-management RPC os command injection

• GL.iNet BE9300
• GL.iNet MT6000
• Command injection

GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection

• GL.iNet A1300
• GL.iNet AX1800
• Command injection

jiantao88 android-mcp-server Command Execution index.js child_process.exec os command injection

• jiantao88 android-mcp-server
• Command injection

COMFAST CF-N1-S mbox-config sub_44A968 command injection

• COMFAST CF-N1-S
• Other injection
• Command injection

An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function

• Command injection

Edimax EW-7478APC stainfo command injection

• Edimax EW-7478APC
• Other injection
• Command injection

Edimax EW-7478APC setWAN command injection

• Edimax EW-7478APC
• Other injection
• Command injection

Edimax EW-7478APC formWlbasic command injection

• Edimax EW-7478APC
• Other injection
• Command injection

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

• Command injection

<5.1.0 · fixed in 5.1.0

Microsoft PowerShell Remote Code Execution Vulnerability

• Microsoft PowerShell 7.4
• Microsoft PowerShell 7.5
• Command injection

Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

• Cockpit HQ Cockpit CMS
• Command injection

IBM Db2 Mirror for i is affected by multiple vulnerabilities

• IBM Db2 Mirror for i
• Command injection

IBM Db2 Mirror for i is affected by multiple vulnerabilities

• IBM Db2 Mirror for i
• Command injection

Haiwell IoT Cloud HMI Gateway OS Command Injection

• Haiwell IoT Cloud HMI Gateway
• Command injection

Command Injection

• Tenable, Inc. Security Center
• Command injection

Command Injection

• Tenable, Inc. Security Center
• Command injection

Improper Input Validation

• Tenable, Inc. Security Center
• Command injection

Local Privilege Escalation

• Tenable, Inc. Security Center
• Command injection

Remote Code Execution

• Tenable, Inc. Security Center
• Command injection

Baicells EG3661M LuCI Web luci os command injection

• Baicells EG3661M
• Command injection

Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

• FreePBX music
• Command injection

FreePBX: Authenticated TTS AGI Command Injection Through TTS Name

• FreePBX tts
• Command injection

Tenda CH7 ATE Module Kylin HandleCmd command injection

• Tenda CH7
• Tenda CH7G
• Other injection
• Command injection

OS command injection in Zimbra Collaboration

• Zimbra Collaboration
• Command injection

rsync < 3.5.0 Command Injection via Multiple Code Paths

• rsync
• Command injection

rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync

• rsync
• Path traversal
• Command injection

Duplicate Advisory: Flowise contains an unauthenticated sandbox escape

• Command injection

<3.1.3 · fixed in 3.1.3