Command injection in OP5 Monitor through version 7.1.9 allows any authenticated low-privilege user to execute arbitrary shell commands on the underlying Linux host via the unsanitized `cmd_str` parameter in the `command_test.php` endpoint. Commands execute as the unprivileged web application user, providing a reliable foothold for further post-exploitation. A Metasploit module (`op5_config_exec.rb`) and an Exploit-DB entry (39676) fully weaponize this vulnerability, and the EPSS score at the 88th percentile reflects elevated real-world exploitation likelihood despite the absence of a CISA KEV listing.
Memory corruption in SQLite versions before 3.50.2 allows network-based attackers with low privileges to manipulate aggregate queries causing integrity impacts. The vulnerability stems from improper validation of aggregate terms against available columns (CWE-197), leading to buffer overflow conditions. CVSS 7.2 (High) with network attack vector but high complexity and partial attack complexity requirements. Vendor-released patch available in SQLite 3.50.2. No confirmed active exploitation (not in CISA KEV), though multiple security advisories from Siemens and OSS-security mailing lists indicate broad downstream impact across industrial control systems and embedded products using SQLite.