NIS2 & DORA Compliance
Regulatory triage for vulnerability prioritization – classification based on existing CVE data
NIS2 Relevant
433
DORA Relevant
65
Internet-Facing
368
Third-Party ICT
65
Unpatched
437
Exploited
67
Framework:
Period:
Sort:
SQL injection in Windmill workflow orchestration platform versions 1.276.0 through 1.603.2 enables authenticated attackers to escalate privileges to administrator and achieve remote code execution. The vulnerability exists in folder ownership management functionality where the owner parameter lacks input sanitization, allowing extraction of JWT signing secrets and administrative user identifiers to forge admin tokens. Publicly available exploit code exists (GitHub POC by Chocapikk), and EPSS risk assessment is critical given the low-complexity remote attack vector requiring only low-privilege authentication. Vendor-released patch: version 1.603.3.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • CRITICAL severity
- • Internet-facing (CWE-89: SQL Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
9.4
CVSS 4.0
0.1%
EPSS
67
Priority
Unauthenticated remote code execution in Weaver E-cology 10.0 (pre-20260312) allows attackers to execute arbitrary system commands via exposed debug functionality at /papi/esearch/data/devops/dubboApi/debug/method. Attackers exploit this by sending crafted POST requests with malicious interfaceName and methodName parameters to invoke command-execution helpers. Confirmed actively exploited (CISA KEV) with exploitation first observed by Shadowserver Foundation on March 31, 2026. Publicly available exploit code exists (h4cker.zip PoC), CVSS 9.8 (Critical), EPSS data not provided but real-world exploitation confirmed.
NIS2
Edge exposure
No patch available
Management plane
PoC
Why flagged?
NIS2 Relevant
- • CRITICAL severity
- • Internet-facing (CWE-306: Missing Authentication for Critical Function)
- • Proof of concept available
- • No patch available
- • Management plane (Missing Authentication for Critical Function)
- • Strong evidence (KEV / high EPSS / multi-source)
9.3
CVSS 4.0
0.3%
EPSS
66
Priority
OS command injection in Anthropic Claude Code CLI and Agent SDK for Python allows remote, unauthenticated attackers to execute arbitrary commands through unsanitized authentication helper parameters processed with shell=true. The vulnerability enables credential theft and environment variable exfiltration in CI/CD pipelines where these tools run with elevated automation privileges. Publicly available exploit code exists, creating immediate risk for organizations using these SDKs in automated workflows.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • CRITICAL severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Moderate evidence (PoC / elevated EPSS)
9.3
CVSS 4.0
0.2%
EPSS
66
Priority
9.1
CVSS 4.0
0.1%
EPSS
66
Priority
Unauthenticated remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables complete system compromise via the setIptvCfg function in /cgi-bin/cstecgi.cgi. Attackers inject malicious commands through the igmpVer parameter without authentication, achieving arbitrary code execution with router privileges. CVSS 9.8 (Critical). Publicly available exploit code exists. No authentication, network-accessible attack vector with low complexity allows immediate weaponization for botnet recruitment, credential theft, or lateral network movement.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
65
Priority
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the pptpPassThru parameter in setVpnPassCfg function of /cgi-bin/cstecgi.cgi. Exploitation requires no user interaction and achieves full system compromise (confidentiality, integrity, availability). Publicly available exploit code exists. Attack vector is network-accessible without authentication (CVSS 8.9 Critical).
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
65
Priority
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in the setUrlFilterRules function of /cgi-bin/cstecgi.cgi. Exploitation requires no user interaction, granting complete device compromise with potential for lateral network movement. Publicly available exploit code exists (GitHub POC). CVSS 9.8 severity reflects network-accessible attack vector with no privilege requirements.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
65
Priority
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the tty_server parameter in the setAdvancedInfoShow function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity reflects network-accessible exploitation requiring no authentication or user interaction. Publicly available exploit code exists. Attackers can achieve full system compromise including data exfiltration, configuration tampering, and denial of service against affected routers.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
65
Priority
Remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 via unauthenticated manipulation of telnet_enabled parameter in setTelnetCfg function. Critical CVSS 9.8 score reflects network-accessible attack requiring no authentication or user interaction, enabling full system compromise. Publicly available exploit code exists. Impacts router confidentiality, integrity, and availability with potential for complete device takeover and lateral network movement.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
65
Priority
OS command injection in Totolink A7100RU 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via malicious lan_info parameter to setMiniuiHomeInfoShow function in /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network attack vector requiring no privileges or user interaction. Publicly available exploit code exists. Complete compromise of confidentiality, integrity, and availability achievable through CGI handler manipulation.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
65
Priority
Remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated attackers to execute arbitrary system commands. The vulnerability resides in the setPortalConfWeChat function within /cgi-bin/cstecgi.cgi, exploitable by manipulating the 'enable' parameter. CVSS 9.8 severity reflects network-accessible attack vector requiring no authentication or user interaction, with full system compromise potential. Publicly available exploit code exists, significantly lowering exploitation barrier for remote attackers targeting vulnerable router deployments.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
65
Priority
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in setUPnPCfg function within /cgi-bin/cstecgi.cgi. Publicly available exploit code exists. No vendor-released patch identified at time of analysis. CVSS 8.9 (Critical) reflects network-accessible attack requiring no user interaction.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
65
Priority
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 enables unauthenticated remote attackers to execute arbitrary system commands via crafted addrPrefixLen parameter in setIpv6LanCfg function of /cgi-bin/cstecgi.cgi CGI handler. CVSS 9.8 critical severity reflects network-accessible attack vector requiring no privileges or user interaction, with complete confidentiality, integrity, and availability impact. Publicly available exploit code exists.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
65
Priority
Remote unauthenticated OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables complete system compromise. Attackers exploit the setPptpServerCfg function in /cgi-bin/cstecgi.cgi CGI handler by injecting malicious commands through the 'enable' parameter. CVSS 9.8 critical severity reflects network-accessible attack requiring no privileges or user interaction. Publicly available exploit code exists, significantly lowering exploitation barrier for remote attackers seeking router takeover, data exfiltration, or network pivoting.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
65
Priority
Unauthenticated OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows remote attackers to execute arbitrary system commands via the wifiOff parameter in the setWiFiGuestCfg function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network-accessible attack vector requiring no authentication or user interaction. Publicly available exploit code exists. Successful exploitation enables complete device compromise with high impact to confidentiality, integrity, and availability.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
65
Priority
Remote unauthenticated OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows arbitrary command execution via the setSyslogCfg function in /cgi-bin/cstecgi.cgi. Attackers exploit the 'enable' parameter without authentication to achieve full system compromise. CVSS 9.8 critical severity reflects network accessibility, no complexity barriers, and complete confidentiality/integrity/availability impact. Publicly available exploit code exists, significantly lowering attack barrier for opportunistic scanning campaigns targeting consumer routers.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
65
Priority
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the User parameter in setVpnAccountCfg function at /cgi-bin/cstecgi.cgi endpoint. CVSS 9.8 critical severity with publicly available exploit code documented on GitHub. No authentication, low complexity, network-accessible attack vector enables full system compromise with high confidentiality, integrity, and availability impact.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
65
Priority
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the admpass parameter in setLoginPasswordCfg function of /cgi-bin/cstecgi.cgi. Network-accessible with no user interaction required. Publicly available exploit code exists. CVSS 9.8 critical severity reflects complete system compromise potential.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
65
Priority
OS command injection in Totolink A7100RU router 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'merge' parameter in setWiFiEasyCfg function within /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity. Publicly available exploit code exists. Attack requires no authentication or user interaction, enabling complete system compromise including data exfiltration, configuration tampering, and denial of service.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.2%
EPSS
65
Priority
Remote OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated attackers to execute arbitrary system commands via the wifiOff parameter in the setWiFiBasicCfg function of /cgi-bin/cstecgi.cgi. This vulnerability enables complete device compromise with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists. No CISA KEV listing identified at time of analysis.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
64
Priority
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the wanIdx parameter in the setDmzCfg function within /cgi-bin/cstecgi.cgi. CVSS 8.9 (Critical) with attack complexity low, no privileges required, and no user interaction. Publicly available exploit code exists. Exploitation enables complete compromise of device confidentiality, integrity, and availability with total technical impact.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
64
Priority
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via crafted sambaEnabled parameter in setStorageCfg function of /cgi-bin/cstecgi.cgi CGI handler. Publicly available exploit code exists. Network-reachable attack vector requires no user interaction, enabling full system compromise of affected routers.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
64
Priority
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands with router privileges via the 'proto' parameter in setNetworkCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, significantly lowering the exploitation barrier. CVSS 9.8 (Critical) reflects network-accessible attack requiring no authentication or user interaction.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
64
Priority
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'mode' parameter in the setWiFiAclRules function (/cgi-bin/cstecgi.cgi). Publicly available exploit code exists. Attackers can achieve complete device compromise with high impact to confidentiality, integrity, and availability of the router. No authentication required for exploitation (CVSS PR:N).
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
0.9%
EPSS
64
Priority
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the CGI interface. The setRadvdCfg function in /cgi-bin/cstecgi.cgi fails to sanitize the maxRtrAdvInterval parameter, enabling command injection through crafted HTTP requests. Publicly available exploit code exists on GitHub, significantly lowering exploitation barriers. CVSS 9.8 critical rating reflects network-accessible attack vector with no authentication or user interaction required, enabling full system compromise.
NIS2
Edge exposure
No patch available
PoC
Why flagged?
NIS2 Relevant
- • HIGH severity
- • Internet-facing (CWE-78: OS Command Injection)
- • Proof of concept available
- • No patch available
- • Strong evidence (KEV / high EPSS / multi-source)
8.9
CVSS 4.0
64
Priority
Page 1 of 25 (619 CVEs)
Next