Command Injection

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will

Mitel MiVoice Connect Command Injection Vulnerability

Broadcom VMware Aria Operations Command Injection Vulnerability

TP-Link Archer AX-21 Command Injection Vulnerability

Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability

Microsoft MSHTML Remote Code Execution Vulnerability

TP-Link Multiple Routers Command Injection Vulnerability

Vmware Aria Operations for Networks Command Injection Vulnerability

Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability

NETGEAR Multiple WAP Devices Command Injection Vulnerability

D-Link DIR-645 Router Remote Code Execution Vulnerability

Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

D-Link DIR-823X Command Injection Vulnerability

PHPMailer Command Injection Vulnerability

Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

QNAP NAS File Station Command Injection Vulnerability

Smartbedded Meteobridge Command Injection Vulnerability

Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

Palo Alto Networks PAN-OS Command Injection Vulnerability

D-Link Multiple NAS Devices Command Injection Vulnerability

Libraesva Email Security Gateway Command Injection Vulnerability

QNAP Network-Attached Storage (NAS) Command Injection Vulnerability

Ubiquiti AirOS Command Injection Vulnerability

Ivanti Pulse Connect Secure Command Injection Vulnerability

D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

BerriAI LiteLLM Command Injection Vulnerability

Cisco Small Business RV Series Routers Command Injection Vulnerability

Sophos Web Appliance Command Injection Vulnerability

D-Link DSL-2750B Devices Command Injection Vulnerability

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy/<server_id>/section/<section_type> and the PUT / global / de

A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_41CF20 of the file /boafrm/formUSSDSetup. The manipulation of the argument ussdValue results in command injection. It is possible to laun

A security vulnerability has been detected in GL.iNet GL-MT3000 4.4.5. The impacted element is the function rpc_sys of the file /cgi-bin/luci/rpc of the component LuCI JSON-RPC Interface. Such manipulation leads to command injection. The at

Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec() method by _cloneWithGit() and fetchRe

filebrowser Allows Shell Commands to Spawn Other Commands

File Browser: Command Execution not Limited to Scope

A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in

A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cgi-bin/glc of the component FTP Protocol Handler. Executing a manipulation of the argument media_dir can lead to command injection. It is pos

A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument dev_name results in comm

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function realpath of the file /rpc of the component Minidlna Service. This manipulation of the argument kube. set causes command injection. The att

A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit

A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client Import Workflow. This manipulation causes command injection. Remote exploitation

A security flaw has been discovered in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function iwinfo_backend of the file iwinfo.so of the component MTK Backend. The manipulation of the argument device results in command injection. The atta

A flaw has been found in Neovim up to 0.12.2. Affected by this issue is the function M.read of the file runtime/lua/vim/secure.lua of the component View Branch. Executing a manipulation of the argument path can lead to command injection. It

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e200 of the file /cgi-bin/glc of the component SET_USER_PWD Handler. The manipulation of the argument Password leads to command injection. The

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. Affected by this issue is the function check_cmd_exists of the file metagpt/utils/common.py. This manipulation of the argument mermaid.path causes command injection. Th

A vulnerability was identified in vertex-app vertex up to 2026.02.12. This issue affects some unknown processing of the file app/model/LogMod.js of the component Log Viewer Endpoint. Such manipulation of the argument req.query leads to os c

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.