Server-side request forgery in tarzan-cms 1.0.0 allows remote attackers to force the application server to initiate arbitrary outbound HTTP connections by manipulating the `httpUrl` argument passed to the `openConnection()` method in `ThemeService.java`. The Theme Download Function passes user-supplied URL input directly to a connection handler without adequate validation, enabling internal network reconnaissance, cloud metadata endpoint access, or pivoting to backend services. A proof-of-concept has been publicly disclosed via a Gitee issue report; no vendor patch exists and the project maintainer has not responded to the disclosure.
Authentication bypass via ID Token claim spoofing in Ping Identity PingAM allows a remote attacker to inject or override protected ID Token claims through a well-crafted request. In vulnerable configurations this lets an attacker impersonate other identities or escalate privileges by forging trusted claims that downstream relying parties consume. Ping Identity has released a patch; no public exploit is identified at time of analysis, and CISA SSVC records exploitation status as none.
SQL injection in the `searchtext` parameter of `listdoctor.php` in subhajitkhan's online-clinic-management-system exposes the backend database to unauthenticated remote attackers. The flaw allows direct manipulation of SQL queries, potentially enabling full database enumeration and data modification. A public proof-of-concept exists via GitHub issue, the maintainer has not responded to disclosure, and no patch has been released for this rolling-release project.
Stack-based buffer overflow in the D-Link DIR-878 router (firmware 120B05) lets an authenticated attacker corrupt the stack by supplying an oversized IPv6Address/Hostname argument to the SetDynamicDNSIPv6Settings handler of the Dynamic DNS IPv6 Settings component. Because the flaw is reachable remotely over the web management interface and the CVSS 4.0 vector indicates full compromise of confidentiality, integrity and availability, successful exploitation can plausibly yield arbitrary code execution on the device. A public advisory exists on GitHub (Amalll-Sec router-vulnerability-research) and VulDB, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow in the D-Link DIR-878 wireless router (firmware 120B05) lets an attacker corrupt the stack through the SetWan3Settings handler of the WAN Settings component by supplying an oversized Primary/Secondary argument (typically DNS/gateway fields). Successful exploitation can crash the device or achieve arbitrary code execution on the router. Reported by VulDB; a third-party technical advisory is published on GitHub, but there is no public exploit identified at time of analysis and it is not in CISA KEV.
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.
Configuration injection in the Froxlor hosting control panel (all versions before 2.2.5) lets an authenticated customer embed literal newline characters in a subdomain redirect URL, which are written verbatim into nginx or Apache vhost configuration files when the privileged cron job rebuilds them. Because the injected lines become active web server directives affecting other hosted domains on the same server, a low-privileged tenant can corrupt configs, cause denial of service, or hijack HTTP responses across co-hosted sites. This is a CWE-93 CRLF/newline-injection flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Regular Labs' Conditional Content Pro extension for Joomla (versions before 8.0.0) lets an author with article-publishing rights embed inline PHP inside Condition Rules, which the extension hands to its Conditions evaluator without verifying who authored the content. Because Joomla's standard Author text filter preserves the rule syntax, publishing a crafted article executes the attacker's PHP as the web-server process. No public exploit has been identified at time of analysis, and the flaw requires an authenticated, privileged Joomla account.
parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.
The BookController download endpoint in novel-plus (all versions through 5.3.3) omits authorization verification, allowing any authenticated backend admin account to export complete book text - including paid chapters - by supplying only a bookId and bookName parameter pair. This endpoint skips the VIP subscription and per-chapter purchase enforcement that the rest of the admin interface correctly applies, enabling unauthorized monetized-content extraction. A public proof-of-concept Python script is confirmed available; no active exploitation has been confirmed by CISA KEV.
Authentication bypass in MISP's optional LdapAuth and LinOTPAuth plugins (versions ≤2.5.45) lets a remote unauthenticated attacker log in as any user whose email they know, without a password. Because LdapAuthenticate and LinOTPAuthenticate reimplement CakePHP's FormAuthenticate but omit its _checkFields() non-empty-string guard, an empty/null password reaches ldap_bind() and - per RFC 4513 §5.1.2 - is treated as an unauthenticated bind that many directories accept as success; impersonation grants the victim's full privileges, potentially administrative. There is no public exploit identified at time of analysis, and SSVC lists exploitation as none, but the technical impact is rated total.
Unauthenticated remote code execution affects ModelTC's LightLLM LLM inference framework in all versions through 1.2.0, where the Config Server's /visual_register WebSocket endpoint deserializes the first client frame with pickle.loads() without any authentication. An attacker who can reach the Config Server port can send a crafted pickle payload whose __reduce__ method runs arbitrary commands with the privileges of the Config Server process. Reported by VulnCheck; a proof-of-concept exists (SSVC exploitation=poc) though the flaw is not listed in CISA KEV.
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and IPresenterActionFilter.OnPresenterExecutingAsync implementations return completed tasks instead of invoking the corresponding checks. Applications relying on this filter can therefore expose protected commands, view models, or presenters to unauthorized requests without any special bypass technique. AuthorizeAttribute correctly implements the same interfaces and can be used as a workaround. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
Sensitive information disclosure in Hiperdino's REST v1.0 API lets a caller holding a valid static bearer token query the public 'customer/check' endpoint with a phone number or email and confirm whether it belongs to a registered customer, returning that customer's email and telephone. The endpoint enforces no per-user authentication beyond a shared static token, applies no rate limiting, and returns distinguishable responses, enabling bulk enumeration of contact details. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks. Prompt-influenced agents can read files through edit and diff behavior or overwrite files accessible to the process, exposing secrets and enabling persistence or application tampering. This issue is fixed in 4.6.62.
Arbitrary file write in Eclipse Embedded CDT 6.0 through 6.7 lets a maliciously crafted CMSIS-Pack archive escape its intended extraction directory and drop files anywhere on the developer's disk. When a user installs or extracts a compromised pack, the plugin's archive handler fails to sanitize entry paths (a classic Zip-Slip-style path traversal), allowing an attacker who controls the pack contents to overwrite or plant arbitrary files. No public exploit is identified at time of analysis, but the SSVC technical impact is rated total and the flaw is automatable.
Remote code execution affects IBM MQ across the 9.1 LTS, 9.2 LTS, 9.3 LTS/CD, 9.4 LTS/CD and 10.0.0.0 release lines because the queue manager deserializes untrusted data (CWE-502), letting an attacker who can already authenticate to the messaging service run arbitrary code under the broker's privileges. The flaw carries a CVSS 3.1 base of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and rates as a credentials-gated but fully compromising issue for any exposed MQ listener. No CISA KEV listing, EPSS score, or public proof-of-concept was present in the supplied intelligence, so active exploitation is unconfirmed at time of analysis; patch availability is signalled by the IBM PSIRT advisory but no fixed build number is stated in the source data.
A remote input-validation weakness in Apple macOS allows crafted data to terminate an application unexpectedly or, more seriously, achieve arbitrary code execution on the host. Apple has fixed the flaw in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27, and only those or later builds are protected. Exploitation requires the victim to interact with the malicious content (CVSS UI:R, PR:N), there is no public exploit code identified at time of analysis, and neither CISA KEV nor the SSVC decision framework indicates observed exploitation, so this is best treated as a patch-now hygiene issue rather than an emergency.
Memory corruption in Apple macOS WebDAV client handling allows code execution when a user connects to an attacker-controlled WebDAV server, affecting macOS versions prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. The flaw is an out-of-bounds write (CWE-787) reachable over the network but gated by user interaction, rated 8.8 by Apple/NVD with an unauthenticated network attack vector. Apple has released fixes in three OS updates, and exploitation is not confirmed — no public exploit code and no CISA KEV listing — while EPSS sits at 0.18% (8th percentile), indicating low predicted mass-exploitation activity; this reads as a credible but targeted risk rather than a wormable event.
Kernel-level use-after-free in Apple's built-in NFS client allows memory corruption when a device connects to an attacker-operated NFS server, affecting iOS/iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires the victim to mount or connect to a malicious NFS share (UI:R) but no credentials or privileges on the target device, making this a remote, unauthenticated-against-the-client attack that terminates in kernel memory corruption with high confidentiality, integrity and availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis; EPSS is low at 0.18% (8th percentile), and CISA SSVC rates exploitation as none and automatable as no, though technical impact is total. Apple has released fixes in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
An out-of-bounds write in Apple's WebKit engine — reachable by processing maliciously crafted web content — can corrupt memory and potentially lead to arbitrary code execution on affected Apple platforms. The flaw stems from an integer-overflow class defect (CWE-190) where a size calculation overflows and the subsequent bounds check fails, allowing an OOB write. It is fixed in Safari 26.6.1, iOS/iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27 and watchOS 27; exploitation requires the victim to load attacker-controlled web content (UI:R), and no public exploit or active exploitation has been identified at time of analysis, with EPSS at just 0.17% (6th percentile).
An integer overflow was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to memory corruption.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.61068_1546_841_CN_TDC allows authenticated remote attackers to corrupt stack memory by supplying an oversized value to the webAuthWhiteUserIndex argument in the formDelWebAuthWhiteUser function, potentially enabling arbitrary code execution in the web server process. The vulnerability is network-exploitable with low-privilege credentials (PR:L per CVSS 4.0), and the CVSS 4.0 score of 8.7 reflects high impact across confidentiality, integrity, and availability. No public exploit has been confirmed and the vulnerability is not in CISA KEV, but a researcher-published GitHub advisory documents the attack surface.
IBM DataStage on Cloud Pak for Data 5.4.0.0 can be made to execute arbitrary code by an authenticated remote user because the XSLT transformation engine is misconfigured in a way that lets attacker-supplied transformations reach code-execution paths. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, C/I/A all High), meaning any holder of valid low-privilege DataStage credentials can potentially obtain full control of the affected service. IBM has published a patch, and there is no public exploit code or CISA KEV listing associated with this CVE at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary operating-system commands with the privileges of the DataStage service account (CVSS 8.8, CWE-78). The flaw requires valid credentials (PR:L) but no user interaction, and successful exploitation yields complete loss of confidentiality, integrity and availability on the affected host or container. IBM has published a vendor patch; there is no CISA KEV entry, no confirmed public exploit code, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which lowers but does not eliminate real-world urgency for exposed deployments.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special characters in the PxPeek name property, allowing an authenticated remote user to inject and execute arbitrary operating-system commands on the DataStage engine. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), reflecting full loss of confidentiality, integrity, and availability for a low-privileged authenticated attacker. A vendor patch is available from IBM, no public exploit code or CISA KEV entry was identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, making it a patch-promptly rather than drop-everything priority.
Missing authorization controls in the ThemeAtelier Domain For Sale WordPress plugin before 3.5.2 expose unauthenticated REST API endpoints that disclose sensitive business data and permit destructive operations. Remote unauthenticated attackers can enumerate all stored offer records, harvest bidder contact information, verification tokens, and messages, and delete arbitrary offers by iterating numeric identifiers. No public exploit is identified at time of analysis, but SSVC marks this as automatable, meaning scripted mass scanning and exploitation across WordPress installations is technically feasible.
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RFC 2822 messages to /admin/mail/inbound-parse and plant arbitrary emails — including forged replies stitched into existing conversation threads — in victim CRM inboxes on every release through 2.2.6. VulnCheck reports proof-of-concept exploit code (SSVC Exploitation: PoC) and the attack is fully automatable, but the issue is not listed in CISA KEV, so active in-the-wild abuse is not confirmed; the CVSS v4.0 base score is 8.8, driven by high integrity impact with no confidentiality impact and only limited availability impact.
Insecure deserialization in the Laravel MagicLink package (cesargb/laravel-magiclink) versions 2.0.0 through 2.25.0 lets an attacker who can already write to the magic_links.action database column — for example via a separate SQL injection or a compromised administrator account — plant a malicious serialized object graph containing an executable closure inside a magic link record. When that link is visited, the package deserializes the record without HMAC integrity checks or class allowlisting and executes the payload as arbitrary PHP code in the application process, yielding full remote code execution at the application's privilege level. The issue is fixed in 2.25.1; there is no public exploit code and no confirmed active exploitation, and CISA's SSVC decision framework records exploitation as 'none' and automatable as 'no'.
LangBot's debug WebSocket server binds to all interfaces on port 5401 and ships with an empty authentication key by default - and the official Docker image together with its docker-compose configuration publish that port to the host, placing every default deployment within reach of any network attacker. A remote unauthenticated attacker who reaches the /plugin/ws endpoint can register an arbitrary debug plugin, after which LangBot broadcasts the full plaintext context of every inbound IM message event to that plugin, enabling mass interception of private chats, forged bot replies, LLM pipeline poisoning via malicious tool registration, knowledge-base enumeration, and persistent denial of service by blocking legitimate plugin installations with the prod_mode flag. No patched version was available at time of publication; SSVC classifies exploitation as proof-of-concept-available and fully automatable.
Apache Doris contains an incorrect authorization flaw (CWE-863) that lets an authenticated user bypass privilege checks and reach data or operations they should not be permitted to touch. Affected branches are 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3; the CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity, and availability impact places this in the critical severity band. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the vendor describes the technical impact as total and CVSS 8.8 reflects broad read/write exposure within the cluster.
Remote authenticated users of the Plesk 'Ruby' (before 1.6.6) and 'Node.js Toolkit' (before 2.5.0) extensions can inject arbitrary shell directives into statically generated application startup code via custom environment variables, resulting in code execution with root privileges on the Plesk server. The flaw is a classic static code injection (CWE-96): user-supplied values are written verbatim into persisted configuration/startup files rather than being escaped. No public exploit code or CISA KEV listing is present in the provided intelligence, and no EPSS score was supplied, so exploitation appears limited to actors who already hold a valid low-privileged Plesk account; vendor patches are available.
Eval injection in CONPROSYS HMI System (CHS) by Contec allows authenticated network attackers to execute arbitrary code on the server hosting the HMI application. The flaw (CWE-95) occurs when user-supplied input reaches a dynamic code evaluation function without proper neutralization, enabling full server-side code execution. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the low-complexity, network-accessible nature of the vulnerability makes it a priority for ICS/OT environments running this product.
Path traversal during in-pod file synchronization in DevSpace through 6.3.21 allows an attacker who controls a container to write arbitrary files on the developer's workstation, enabling code execution. The sync client extracts tar entries streamed from a running pod without sanitizing parent-directory (..) sequences in entry names, so a malicious container can escape the intended sync target directory and overwrite shell RC files, SSH authorized_keys, IDE configuration, or other user-writable paths. No CISA KEV listing exists and no confirmed public exploit code has been identified at time of analysis, though the VulnCheck disclosure and GitHub issue #3290 provide full technical detail.
Path traversal via share link in ZFile through 5.0.5 enables any holder of a valid share link to download arbitrary files within the configured shared base directory by supplying unvalidated file path parameters to the download endpoint. The root failure - confirmed in ShareLinkFileService.java - is that the download endpoint never cross-checks the caller-supplied path against the share link's permitted entries, so a share granting access to one file silently grants read access to every readable file under the base directory. No public exploit code has been confirmed at time of analysis, though the vulnerability is publicly documented in GitHub issue #826 and no patched version number has been independently verified.
Authenticated SQL injection in the timescale-reader and postgres-reader HTTP APIs of Magistrala before 1.0.0 lets any user who can self-register inject arbitrary SQL through the unparameterized `format` query parameter, which is interpolated straight into the FROM clause of backend queries. Because the injected statements run as a PostgreSQL superuser under the default role configuration, an attacker can pivot from cross-tenant data theft to reading pg_shadow password hashes, reading and writing arbitrary files, and executing OS-level code as the postgres user via shared-object loading. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the vendor has released a fix in v1.0.0.
Memory exhaustion in adnanh/webhook through 2.8.3 allows unauthenticated remote attackers to crash the service by streaming multi-gigabyte HTTP request bodies at any configured hook endpoint. The daemon reads the entire request body into memory before it evaluates trigger rules or validates the payload signature, so invalid or unsigned requests are just as effective as valid ones at forcing an out-of-memory kill. SSVC rates the issue as automatable and already exploited by proof-of-concept code, though there is no CISA KEV listing and no vendor-issued fix version identified in the available references.
Unauthenticated arbitrary file read in DeepWiki-Open (AsyncFuncAI) through commit d92819a lets anyone who can reach the /ws/chat WebSocket endpoint pass an arbitrary directory path as the repo_url parameter and have the server walk that path with no containment check, exfiltrating every readable Python, JavaScript, YAML and JSON file it finds. Because the read is aimed at source and configuration files, the practical payoff is hardcoded secrets, API keys and credentials rather than code execution. A public proof of concept is indicated by SSVC exploitation status and the flaw is fully automatable, though it is not listed in CISA KEV as actively exploited.
Unauthenticated SQL injection in EFence (Thinking Software Technology) exposes full database read access to remote attackers without credentials. The flaw resides in the web-facing component of the EFence product, where attacker-controlled input is passed unsanitized into SQL queries, enabling arbitrary SELECT operations against the underlying database. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the trivial exploitation conditions (no authentication, no user interaction, network-accessible) make it a high-priority remediation target for any deployment.
OS command injection in Contec SolarView Compact (models SV-CPT-MC310 and SV-CPT-MC310F) allows any authenticated low-privilege user to execute arbitrary operating system commands through the Schedule Settings feature. Successful exploitation grants full control over the underlying device with high impact to confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity makes this a straightforward target for any attacker holding valid credentials.
OS command injection in Contec's CAN-2-WF (Wireless LAN) and CAN-2-USB (USB) industrial communication converter units allows any authenticated user to execute arbitrary operating system commands on the device. The vulnerability, CWE-78, is reachable over the network with low privilege and no user interaction required, yielding full confidentiality, integrity, and availability impact on the affected unit. Reported by JPCERT/CC with a vendor advisory published; no public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis.
Missing authentication on a critical function in the Contec CPSL-08P1EN allows a network-reachable attacker to operate the device without supplying credentials. The flaw (CWE-306) means a protected management or control function is reachable directly over the network with no authentication gate, giving an adversary the same effective access as a legitimate administrator. No public exploit or CISA KEV listing exists at time of analysis, but the straightforward exploitation path (no complexity, no user interaction) lowers the bar for opportunistic targeting of Internet-exposed or weakly-segmented devices.
Arbitrary command execution via unrestricted file upload affects CONTEC's CONPROSYS TM Series industrial controllers (CPS-TM341G5MB-ADSC1-931, CPS-TM341MB-ADSC1-931, and CPS-TM341GMB-ADSC1-931). A remote attacker holding valid credentials can upload a specially crafted file through the device's management interface, causing the underlying system to execute attacker-controlled commands. The CVSS 4.0 score of 8.7 reflects full confidentiality, integrity, and availability compromise of the vulnerable system, with authentication as the sole barrier to exploitation. No public exploit or CISA KEV listing has been identified at time of analysis.
Authenticated OS command injection in Contec CONPROSYS TM Series industrial devices allows any logged-in user to execute arbitrary operating system commands on the underlying host. Specifically, three CPS-TM341 model variants are confirmed affected per JVN advisory JVNVU96551518. Exploitation is straightforward once credentials are obtained, making credential theft or default-credential abuse a natural precursor attack chain.
OS command injection in Contec's CONPROSYS PAC Series industrial automation controllers allows any authenticated user to execute arbitrary OS-level commands on the device. Affected hardware includes the Integrated Type CPS-PC341 and Configurable Type CPS-PCS341 series programmable automation controllers, reported by JPCERT/CC. No public exploit code has been identified at time of analysis, but successful exploitation grants full control over the controller's underlying operating system.
OS command injection in CONPROSYS M2M Gateway and M2M Controller Series (CONTEC Co., Ltd.) allows an authenticated attacker to execute arbitrary operating system commands on affected industrial gateway devices. The vulnerability affects both the integrated and configurable variants of the CPS-MG341, CPS-MGS341, CPS-MC341, and CPS-MCS341 product lines, which are OT/IoT bridging devices commonly deployed in industrial automation environments. Exploitation requires only valid login credentials, and the CVSS 4.0 base score of 8.7 reflects high impact across confidentiality, integrity, and availability with no special attack conditions beyond authentication.
Remote code execution affects the Contec EC1000 series (ECE1000, ECE1020, ECS1020) industrial devices, where a classic buffer overflow in the embedded web service allows a network-authenticated attacker to send a specially crafted HTTP request and execute arbitrary programs on the device. Reported by JPCERT/CC via JVN advisory JVNVU99009004, this is an embedded industrial controller flaw with full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Contec RP-WAH-SR Series wireless access point devices via a classic buffer overflow in the product's web service. A low-privileged remote attacker can send a specially crafted HTTP request to trigger the overflow and execute arbitrary code on the device. All four model variants (SR1, SR2, SR12, SR22) are confirmed affected per CPE data; the vulnerability was disclosed via JPCERT and a Contec security advisory with no KEV listing or public POC at time of analysis.
OS command injection in Contec's SGA1000 device allows an authenticated network attacker to execute arbitrary commands on the underlying operating system. The flaw (CWE-78) arises from insufficient sanitization of user-supplied input before it is passed to system shell calls, affecting all known versions per the wildcard CPE specifier. Reported via JPCERT/CC and confirmed by the vendor's own security advisory; no public exploit code has been identified at time of analysis.