Command injection.

OS command injection in Schneider Electric NetBotz 5 - 750/755

• Schneider Electric NetBotz 5 - 750/755
• Command injection

LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname

• librenms
• Command injection

ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injection

• ICP DAS UA-2200
• ICP DAS UA-5200
• Other injection
• Command injection

yast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied)

• SUSE yast2-samba-client
• Command injection

yast2-auth-client: OS command injection via unsanitized Organizational Unit / dnsHostName in AD join

• SUSE yast2-auth-client
• Command injection

yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute

• SUSE yast2-users
• Command injection
• CWE-1287

Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection

• Cobham SATCOM VSAT7090 Maritime Satellite Router
• Other injection
• Command injection

OS command injection in WebPros Plesk

• WebPros Plesk
• Command injection

RedPort Optimizer wXa-223 System Clock datetime.php exec command injection

• RedPort Optimizer wXa-203
• RedPort Optimizer wXa-213
• Other injection
• Command injection

QVidium Opera11 CGI Script net_tr.cgi command injection

• QVidium Opera11
• Other injection
• Command injection

Edimax BR-6214K asp_setPing Endpoint ping.asp system os command injection

• Edimax BR-6214K
• Command injection

Command Injection vulnerability in eObčanka-Identifikace

• Ministry of the Interior (MVČR) eObčanka-Identifikace
• Command injection

Edimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injection

• Edimax BR-6214K
• Command injection

OS Command Injection in TÜBİTAK BİLGEM's Pardus Boot Repair

• TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair
• Command injection

D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection

• D-Link DNS-340L
• D-Link DNS-345
• Command injection

D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection

• D-Link DNS-320L
• D-Link DNS-327L
• Command injection

D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection

• D-Link DNS-327L
• D-Link DNS-340L
• Command injection

D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection

• D-Link DNS-320L
• D-Link DNS-327L
• Command injection

D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection

• D-Link DNS-340L
• D-Link DNS-345
• Command injection

diem-project diem Administrative Console actions.class.php executeCommand os command injection

• diem
• Command injection

klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection

• klaussilveira GitList
• Command injection

TOTOLINK NR1800X cstecgi.cgi setUssd command injection

• TOTOLINK NR1800X
• Other injection
• Command injection

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py.

• Command injection

D-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injection

• D-Link DIR-825M
• Other injection
• Command injection

OS command injection in Qubes OS

• Qubes OS
• Command injection

PowSyBl Core has Command Injection in LocalCommandExecutor-s

• Command injection

<7.2.2 · fixed in 7.2.2

JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values

• shriyanss js-recon
• Command injection

Synk Sweater Comb < 3.8.8 Command Injection via .vervet.yaml Branch Name

• snyk sweater-comb
• Command injection

PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post

• PLANET Technology Corp. PLANET GS-4210-16P2S V3
• Command injection

PLANET GS-4210-16P2S V3 Command Injection via httpuploadcert.cgi

• PLANET Technology Corp. PLANET GS-4210-16P2S V3
• Command injection

PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post

• PLANET Technology Corp. PLANET GS-4210-16P2S V3
• Command injection

Green-Computing｜NUMail - OS Command Injection

• Green-Computing NUMail
• Command injection

OS command injection in openNDS

• openNDS
• Command injection

OS command injection in openNDS

• openNDS
• Command injection

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' par…

• Command injection

An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input.

• Command injection

Wazuh: Missing input validation in multiple active response scripts allows argument injection

• wazuh
• Command injection

Xiiaozet LK100W OS Command Injection

• Xiiaozet LK100W
• Command injection

OS Command Injection in PayRange API

• Zoneminder
• Command injection

Connection-option injection via unescaped settings in the canonical MongoDB URL builder

• MongoDB C# Driver
• Command injection

openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers ca...

• Command injection

<1.4.9 · fixed in 1.4.9

rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape

• maquina-app rails-mcp-server
• Command injection

Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)

• limanmys core
• Command injection
• CWE-20

AlexGladkov claude-in-mobile client.ts execSync os command injection

• AlexGladkov claude-in-mobile
• Command injection

Zbtlink MQWrt infosrvd Command Injection

• Zbtlink WE1326
• Zbtlink WE2426-C
• Command injection
• Hard-coded credentials

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17).

• Command injection

OS command injection in Dell PowerProtect One

• Dell PowerProtect One
• Command injection

OS command injection in Dell PowerProtect One

• Dell PowerProtect One
• Command injection

OS command injection in Dell Cloud Disaster Recovery

• Dell Cloud Disaster Recovery
• Command injection

OS command injection in Dell Cloud Disaster Recovery

• Dell Cloud Disaster Recovery
• Command injection

bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option Delimiter

• nfriedly bestzip
• Command injection

Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling

• TeamViewer Full Client
• TeamViewer Host
• Command injection

LibreNMS Virtualisation Discovery Module RCE

• librenms
• Command injection

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name parameter.

• Command injection

An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, display_n.

• Command injection

An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder.

• Command injection

An issue was discovered in LibreNMS 1.65.

• Command injection

TOTOLINK N600R cstecgi.cgi getCurrentTime command injection

• TOTOLINK N600R
• Other injection
• Command injection

ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter

• MacWarrior clipbucket-v5
• Command injection

zackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injection

• zackees transcribe-anything
• Command injection