Command injection.

OS command injection in PFU Limited Image Scanner Driver for Linux (fi Series) and others

• PFU Limited Image Scanner Driver for Linux (fi Series)
• PFU Limited Image Scanner Driver for Linux (SP Series)
• Command injection

AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR

• beenuar AiSOC
• Command injection

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.

• Command injection

Ziroom ZHOME A0101 ping command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

Ziroom ZHOME A0101 set_time_zone command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

Ziroom ZHOME A0101 set_syslog command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5

• Anjvision YSSD-RTMP-H5
• Command injection

Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON

• Hewlett Packard Enterprise (HPE) Instant ON
• Command injection

Unauthenticated Adjacent Command Injection Vulnerability in HPE Networking Instant ON APs Command Line Interface (CLI) Accessed by the PAPI Protocol

• Hewlett Packard Enterprise (HPE) Instant ON
• Command injection

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Command injection

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Command injection

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Command injection

Akaunting before 2.1.31 OS Command Injection via app alias

• akaunting
• Command injection

Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

• weblate
• Command injection

Apache DolphinScheduler: Command Injection in the Alert Script Plugin

• Apache Software Foundation Apache DolphinScheduler
• Command injection

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

• esengine DeepSeek-Reasonix
• Command injection

MODSetter SurfSense MCP Connector Integration test command injection

• MODSetter SurfSense
• Other injection
• Command injection

Netcore NAP930 Network Tools CGI network_tools eval os command injection

• Netcore NAP930
• Command injection

RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection

• raspap-webgui
• Command injection

RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection

• raspap-webgui
• Command injection

mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection.

• Command injection

Ziroom ZHOME A0101 set_passwd command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

Ziroom ZHOME A0101 set_online_client command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

Ziroom ZHOME A0101 set_online_client command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

Ziroom ZHOME A0101 firstSetup_wifi command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

Ziroom ZHOME A0101 firstLogin command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter

• Brainstorm Force ConvertPlus
• Command injection

FreePBX: Authenticated API generatedocs Host Command Injection

• FreePBX security-reporting
• Command injection

Authenticated Command Injection in FreePBX UCP Interface

• FreePBX security-reporting
• Command injection

FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

• FreePBX security-reporting
• Command injection

WatchGuard AP Command Injection in Internal Management API Allows Command Execution

• WatchGuard AP
• Command injection
• Broken access control

WatchGuard AP Authenticated Command Injection in Diagnostic CLI

• WatchGuard AP
• Command injection

Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection

• Netcore NR289-GE
• Command injection

Netcore NR289-GE Location Time location_time.cgi system os command injection

• Netcore NR289-GE
• Command injection

macOS Exam4 Local Privilege Escalation via Command Injection

• Extegrity Exam4
• Command injection

code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)

• Command injection

<0.36.1 · fixed in 0.36.1

Netcore NR289-GE CGI ap_ip.cgi system os command injection

• Netcore NR289-GE
• Command injection

Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal

• Red Hat Openshift Data Foundation 4
• Command injection

OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes

• SUSE NeuVector
• Command injection

Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

• Apache Software Foundation Apache Karaf
• Command injection

OS command injection in BUFFALO INC. WSR-300HP and others

• BUFFALO INC. WSR-300HP
• BUFFALO INC. WEX-G300
• Command injection

aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection

• aaPanel BaoTa
• Command injection

aaPanel BaoTa File Merge files.py merge_split_file command injection

• aaPanel BaoTa
• Other injection
• Command injection

aaPanel BaoTa Database Backup database.py InputSql os command injection

• aaPanel BaoTa
• Command injection

Netcore NBR200V2 Tools Ping network_tools system os command injection

• Netcore NBR200V2
• Command injection

Netcore NBR200V2 Web Management network_tools eval os command injection

• Netcore NBR200V2
• Command injection

TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection

• TOTOLINK N150RT
• Command injection

Fleet Homebrew Cask OS Command Injection via Metadata

• fleet
• Command injection

navi through 2.24.0 OS Command Injection via Cheatsheet Variables

• denisidoro navi
• Command injection

AzuraCast before 0.23.8 Command Injection via Streamer Username

• AzuraCast
• Command injection

Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

• froxlor
• Command injection

OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome

• OpenClaw
• Command injection

OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS

• OpenClaw
• Command injection

OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper

• OpenClaw
• Command injection

OpenClaw before 2026.8.1 Command Injection via Escaped Newlines

• OpenClaw
• Command injection

CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers

• Command injection

>=1.0.0-rc.1, <2.0.2 · fixed in 2.0.2

CliInvoke: Argument Injection in Extensibility Runner Factory

• Command injection

>=2.0.0-alpha.1, <2.0.2 · fixed in 2.0.2

Unauthenticated remote code execution through wikitext in ExternalData

• Wikimedia Foundation Mediawiki - ExternalData Extension
• Command injection

Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fields

• GNOME NetworkManager-sstp
• Command injection