Command injection.

Argument injection in Proxmox pmg-api

• Proxmox pmg-api
• Command injection

MaxKB: Prompt-injectable agent can lead to command execution

• 1Panel-dev MaxKB
• Command injection
• Privilege escalation

MaxKB AWS Bedrock model credential injection leads to remote code execution

• 1Panel-dev MaxKB
• Command injection

luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root

• openwrt luci
• Command injection

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe

• Command injection

ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API

• ntopng
• Command injection

OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5

• Dassault Systèmes Tuleap Enterprise Edition
• Command injection

Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host

• Temporal Technologies, Inc. Temporal Server
• Command injection
• CWE-749

Chengdu Feiyuxing Technology Feiyu Star Router Cookie send_order.cgi command injection

• Chengdu Feiyuxing Technology Feiyu Star Router
• Other injection
• Command injection

Chengdu Feiyuxing Technology Feiyu Star Router send_order.cgi command injection

• Chengdu Feiyuxing Technology Feiyu Star Router
• Other injection
• Command injection

Netcore NBR200V2 Backup Restore restore.cgi command injection

• Netcore NBR200V2
• Other injection
• Command injection

Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection

• Netcore NBR200V2
• Other injection
• Command injection

An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components

• Command injection

Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection

• Netcore NBR200V2
• Other injection
• Command injection

Netcore NBR200V2 LAN IP Configuration network_tools command injection

• Netcore NBR200V2
• Other injection
• Command injection

Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection

• Netcore NBR200V2
• Other injection
• Command injection

0-Gaurav-0 nexus-mcp nexus_reauth MCP tool browser.ts child_process.exec command injection

• 0-Gaurav-0 nexus-mcp
• Other injection
• Command injection

getID3 before 1.9.26 OS Command Injection via Unescaped Filenames

• james-heinrich getid3
• Command injection

aiyiyi121 SxDevOps Command services.py generate_host_task command injection

• aiyiyi121 SxDevOps
• Other injection
• Command injection

aiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injection

• aiyiyi121 SxDevOps
• Other injection
• Command injection

aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injection

• aiyiyi121 SxDevOps
• Other injection
• Command injection

D-Link R95 DHMAPI ssi system os command injection

• D-Link R95
• Command injection

Totolink A3002MU formWsc command injection

• Totolink A3002MU
• Other injection
• Command injection

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Command injection

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Command injection

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Command injection

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Command injection

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Command injection

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Command injection

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Command injection

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Command injection

IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [, ]

• i
• Command injection

btrbk: SSH Command Filter Bypass in ssh_filter_btrbk.sh

• digint btrbk
• Command injection

spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection

• spatie Scotty
• Command injection

IBM Cloud Pak for Data is vulnerable to OS command injection

• IBM Cloud Pak for Data
• Command injection

PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Server

• PLANET Technology Corp. PLANET IGS-5225-8P2T4S V1
• PLANET Technology Corp. PLANET IGS-5225-8P2T4S V2
• Command injection

Privilege Escalation via Argument Injection in NetBackup Flex OS Shell

• Cohesity NetBackup Flex OS
• Command injection

marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection

• marcopiovanello yt-dlp-web-ui
• Other injection
• Command injection

NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.

• Command injection

Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability

• Microsoft 365 Copilot's Business Chat
• Command injection
• CWE-923

Microsoft 365 Copilot Elevation of Privilege Vulnerability

• Microsoft 365 Copilot
• Command injection

Microsoft Copilot Information Disclosure Vulnerability

• Microsoft Copilot
• Command injection

JabRef CAYW Sublime Text integration permits operating-system command injection

• jabref
• Command injection

Browsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors

• webrecorder browsertrix
• Command injection
• Privilege escalation

NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection

• nm-l2tp NetworkManager-l2tp
• Command injection

Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection

• Dromara mayfly-go
• Command injection

SSH.NET: ScpClient allows server-side RCE via default SCP path handling

• Command injection

<2026.0.0 · fixed in 2026.0.0

mport package fetch and clean paths are vulnerable to TOCTOU filesystem races

• MidnightBSD mport
• Command injection
• Race condition

Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter

• appwrite
• Command injection

pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool

• pgadmin.org pgAdmin 4
• Path traversal
• Command injection

pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools

• pgadmin.org pgAdmin 4
• Command injection
• Hard-coded credentials

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

• Command injection

<6.0.0 · fixed in 6.0.0

OS command injection in FatPipe Networks MPVPN and others

• FatPipe Networks MPVPN
• FatPipe Networks WARP
• Command injection

OS command injection in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others

• Dell OpenManage Server Administrator Managed Node (Patch) for Windows
• Dell OpenManage Server Administrator Managed Node for RHEL 8.10
• Command injection

The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BR_g8.10_1.11(WVK.0)b46 allow authenticated users execute arbitrary OS command via concatenat…

• Command injection

AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF

• WWBN AVideo
• Command injection

Cisco Identity Services Engine IPSec Open API Command Injection Vulnerability

• Cisco Identity Services Engine Software
• Command injection

Cisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection Vulnerability

• Cisco ThousandEyes Enterprise Agent
• Command injection

Cisco Identity Services Engine Remote Code Execution Vulnerability

• Cisco Identity Services Engine Software
• Command injection

Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Neutralization of Special Elements used in a Command

• Cisco Nexus Dashboard
• Command injection