CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Monthly
Command injection in Netgate pfSense CE 2.7.0 through 2.9.0 lets an authenticated administrator who holds IPsec Mobile configuration privileges store a crafted single-line login banner that escapes the unquoted strongswan.conf attr value and injects charon.start-scripts entries, resulting in command execution as root on the firewall. Exploitation is gated by high privilege (PR:H) and by a charon restart precondition - the injected payload only runs when the strongSwan daemon is restarted, not at submission time - but publicly available exploit code exists and the impact on confidentiality, integrity, and availability is high. This is a genuine high-priority issue for organizations running affected pfSense CE firewalls, but its exploitation is gated by privilege rather than exposure, and no unauthenticated or unprivileged path has been identified.
Remote, unauthenticated injection in the Progress Kendo UI for jQuery PivotGrid XMLA transport (all versions prior to v2026.3.1015) lets an attacker place crafted filter values into MDX predicates and the surrounding SOAP request body, altering the query issued to a backend XMLA/OLAP data source such as Microsoft SQL Server Analysis Services. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH) - data reachable through the configured XMLA connection may be read or exposed, but integrity and availability of the source are not affected. Only applications that render PivotGrid with the XMLA transport enabled and a reachable OLAP backend are exposed; no public exploit was identified at time of analysis and the issue is not confirmed as actively exploited.
Remote code execution in ThemeHigh's Email Customizer for WooCommerce (Pro) through version 3.9.5 allows any authenticated user with subscriber-level access or higher to write attacker-controlled PHP into executable files inside the WordPress uploads directory through the plugin's send_test_mail() function, leading to full site compromise. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) makes clear that the low-privilege account requirement is the main gate; exposure is greatest on WooCommerce stores that permit open customer/subscriber self-registration rather than manual account approval. Code execution also depends on the server permitting PHP to run from the uploads path, so sites that already harden that directory are materially less exposed, and no public exploit code has been identified at time of analysis.
Improper neutralization of special elements (CWE-74) in Microsoft's Azure Storage client libraries - azure-storage-blob-batch 1.0.0 and the Azure Storage Blobs client library for Java - allows an attacker who already holds low-level authorized access (PR:L) to escalate privileges over the network by routing crafted input through the library into a downstream component that does not sanitize it. The weakness requires no user interaction (UI:N) and produces high integrity and availability impact (I:H/A:H) with no confidentiality loss (C:N), which is consistent with Microsoft's 'Code Injection' tagging. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and the issue as not automatable, so real-world urgency sits below what the 8.1 base score alone would imply.
Newline injection in the Ftps.add API of Froxlor 0.10.0 through versions prior to 2.3.14 lets an authenticated customer account insert arbitrary entries into the root-owned NSS group database, ultimately enabling local privilege escalation on affected hosts. The unvalidated additional_members parameter accepts embedded newline characters, and the REBUILD_NSSUSERS cron job later writes those values without sanitization into /var/lib/extrausers/group, so an attacker with a valid customer login can seed privileged group memberships that are cashed in only once they obtain local access to the machine. Exploitation is gated by customer-level authentication (CVSS vector PR:L) and by the host being deployed with the libnss-extrausers backend with the rebuild cron active; no public exploit code identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status.
Unauthenticated command injection in Edimax BR-6208AC firmware version 1.32 allows a remote attacker to execute arbitrary operating-system commands on the router by supplying crafted input through the readE2P argument of the /goform/formWlanMP endpoint. The issue is rated critical (CVSS 4.0 base 9.3; an independent assessment reaches the equivalent CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and publicly available exploit code exists, although there is no confirmation of active exploitation (device is not in CISA KEV). The vendor was contacted early and did not respond, and the product is no longer supported, so the decisive practical concern is permanent exposure: any BR-6208AC 1.32 whose web management interface is reachable over the WAN or from an untrusted network segment remains exploitable indefinitely.
Authenticated attackers who already hold low-privileged access to a local or management interface of Cisco Meraki MR wireless access points, MV cameras, MX security appliances, or Cisco Campus Gateway Software can supply crafted input that the affected component fails to neutralize correctly, a CWE-74 injection-class condition rated CVSS 8.8 with scope change (S:C) and high confidentiality, integrity, and availability impact. Because the vector is AV:L with PR:L, the attacker must already be able to reach the device's management or local interface - exposure is tied to the management plane rather than the public internet - and the flaws were identified during a Cisco internal security review rather than through external reporting, with fixes delivered as software hardening releases described in Cisco advisory cisco-sa-hardening-meraki-os-drbEX9GH. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the specific vulnerable feature and exact affected firmware builds are not specified in the available data.
Authenticated SQL injection in the Arista CloudVision CUE API allows a network user with valid credentials to degrade backend availability by supplying malicious values in specific request parameters that lack proper validation. The CVSS 4.0 score is 7.1 (High), driven entirely by high availability impact (VA:H) with zero confidentiality or integrity impact (VC:N/VI:N), which is atypical for SQL injection. No public exploit code has been identified at time of analysis, and exploitation requires prior authentication (PR:L).
Unauthenticated input injection in ViewSonic vCast, the wireless screen-casting service bundled with ViewBoard interactive displays, lets a remote attacker push crafted HTTP requests at exposed service endpoints and have that data accepted without validation, which public research chains onward to remote code execution. Affected builds span vCast v0.0.0 through v3.2.715 and are reachable over the network with no credentials and no user interaction (CVSS 9.8, AV:N/PR:N/UI:N), so every ViewBoard whose vCast endpoints are network-reachable is exposed; a public technical write-up describing the exploit chain exists (blog.l3afs.space), while no CISA KEV entry confirms active exploitation at time of analysis. All available signals point to genuinely high real-world risk, with the practical limiting factor being network reachability of the vCast service rather than any missing precondition.
Command injection in the Ziroom ZHOME A0101 smart-home gateway running firmware 1.0.1.0 allows a remote, high-privilege authenticated attacker to execute arbitrary operating-system commands on the device by supplying shell metacharacters in the 'url' argument of the /api/ZRnetwork/ping diagnostic endpoint. Publicly available exploit code exists - the reporting researcher published a proof-of-concept write-up on GitHub - and the vendor was contacted early about the disclosure but never responded, so no vendor-released patch is available and no CISA KEV entry or EPSS score was provided in the source data. The published CVSS 4.0 score of 8.5 is driven upward by subsequent-system (SC:H/SI:H/SA:H) metrics that our independent assessment considers inflated for a single embedded gateway; the practical risk is bounded by the PR:H administrative authentication prerequisite in the vector and by the fact that consumer smart-home management interfaces such as this are normally reachable only from the LAN.
Command injection in Netgate pfSense CE 2.7.0 through 2.9.0 lets an authenticated administrator who holds IPsec Mobile configuration privileges store a crafted single-line login banner that escapes the unquoted strongswan.conf attr value and injects charon.start-scripts entries, resulting in command execution as root on the firewall. Exploitation is gated by high privilege (PR:H) and by a charon restart precondition - the injected payload only runs when the strongSwan daemon is restarted, not at submission time - but publicly available exploit code exists and the impact on confidentiality, integrity, and availability is high. This is a genuine high-priority issue for organizations running affected pfSense CE firewalls, but its exploitation is gated by privilege rather than exposure, and no unauthenticated or unprivileged path has been identified.
Remote, unauthenticated injection in the Progress Kendo UI for jQuery PivotGrid XMLA transport (all versions prior to v2026.3.1015) lets an attacker place crafted filter values into MDX predicates and the surrounding SOAP request body, altering the query issued to a backend XMLA/OLAP data source such as Microsoft SQL Server Analysis Services. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH) - data reachable through the configured XMLA connection may be read or exposed, but integrity and availability of the source are not affected. Only applications that render PivotGrid with the XMLA transport enabled and a reachable OLAP backend are exposed; no public exploit was identified at time of analysis and the issue is not confirmed as actively exploited.
Remote code execution in ThemeHigh's Email Customizer for WooCommerce (Pro) through version 3.9.5 allows any authenticated user with subscriber-level access or higher to write attacker-controlled PHP into executable files inside the WordPress uploads directory through the plugin's send_test_mail() function, leading to full site compromise. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) makes clear that the low-privilege account requirement is the main gate; exposure is greatest on WooCommerce stores that permit open customer/subscriber self-registration rather than manual account approval. Code execution also depends on the server permitting PHP to run from the uploads path, so sites that already harden that directory are materially less exposed, and no public exploit code has been identified at time of analysis.
Improper neutralization of special elements (CWE-74) in Microsoft's Azure Storage client libraries - azure-storage-blob-batch 1.0.0 and the Azure Storage Blobs client library for Java - allows an attacker who already holds low-level authorized access (PR:L) to escalate privileges over the network by routing crafted input through the library into a downstream component that does not sanitize it. The weakness requires no user interaction (UI:N) and produces high integrity and availability impact (I:H/A:H) with no confidentiality loss (C:N), which is consistent with Microsoft's 'Code Injection' tagging. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and the issue as not automatable, so real-world urgency sits below what the 8.1 base score alone would imply.
Newline injection in the Ftps.add API of Froxlor 0.10.0 through versions prior to 2.3.14 lets an authenticated customer account insert arbitrary entries into the root-owned NSS group database, ultimately enabling local privilege escalation on affected hosts. The unvalidated additional_members parameter accepts embedded newline characters, and the REBUILD_NSSUSERS cron job later writes those values without sanitization into /var/lib/extrausers/group, so an attacker with a valid customer login can seed privileged group memberships that are cashed in only once they obtain local access to the machine. Exploitation is gated by customer-level authentication (CVSS vector PR:L) and by the host being deployed with the libnss-extrausers backend with the rebuild cron active; no public exploit code identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status.
Unauthenticated command injection in Edimax BR-6208AC firmware version 1.32 allows a remote attacker to execute arbitrary operating-system commands on the router by supplying crafted input through the readE2P argument of the /goform/formWlanMP endpoint. The issue is rated critical (CVSS 4.0 base 9.3; an independent assessment reaches the equivalent CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and publicly available exploit code exists, although there is no confirmation of active exploitation (device is not in CISA KEV). The vendor was contacted early and did not respond, and the product is no longer supported, so the decisive practical concern is permanent exposure: any BR-6208AC 1.32 whose web management interface is reachable over the WAN or from an untrusted network segment remains exploitable indefinitely.
Authenticated attackers who already hold low-privileged access to a local or management interface of Cisco Meraki MR wireless access points, MV cameras, MX security appliances, or Cisco Campus Gateway Software can supply crafted input that the affected component fails to neutralize correctly, a CWE-74 injection-class condition rated CVSS 8.8 with scope change (S:C) and high confidentiality, integrity, and availability impact. Because the vector is AV:L with PR:L, the attacker must already be able to reach the device's management or local interface - exposure is tied to the management plane rather than the public internet - and the flaws were identified during a Cisco internal security review rather than through external reporting, with fixes delivered as software hardening releases described in Cisco advisory cisco-sa-hardening-meraki-os-drbEX9GH. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the specific vulnerable feature and exact affected firmware builds are not specified in the available data.
Authenticated SQL injection in the Arista CloudVision CUE API allows a network user with valid credentials to degrade backend availability by supplying malicious values in specific request parameters that lack proper validation. The CVSS 4.0 score is 7.1 (High), driven entirely by high availability impact (VA:H) with zero confidentiality or integrity impact (VC:N/VI:N), which is atypical for SQL injection. No public exploit code has been identified at time of analysis, and exploitation requires prior authentication (PR:L).
Unauthenticated input injection in ViewSonic vCast, the wireless screen-casting service bundled with ViewBoard interactive displays, lets a remote attacker push crafted HTTP requests at exposed service endpoints and have that data accepted without validation, which public research chains onward to remote code execution. Affected builds span vCast v0.0.0 through v3.2.715 and are reachable over the network with no credentials and no user interaction (CVSS 9.8, AV:N/PR:N/UI:N), so every ViewBoard whose vCast endpoints are network-reachable is exposed; a public technical write-up describing the exploit chain exists (blog.l3afs.space), while no CISA KEV entry confirms active exploitation at time of analysis. All available signals point to genuinely high real-world risk, with the practical limiting factor being network reachability of the vCast service rather than any missing precondition.
Command injection in the Ziroom ZHOME A0101 smart-home gateway running firmware 1.0.1.0 allows a remote, high-privilege authenticated attacker to execute arbitrary operating-system commands on the device by supplying shell metacharacters in the 'url' argument of the /api/ZRnetwork/ping diagnostic endpoint. Publicly available exploit code exists - the reporting researcher published a proof-of-concept write-up on GitHub - and the vendor was contacted early about the disclosure but never responded, so no vendor-released patch is available and no CISA KEV entry or EPSS score was provided in the source data. The published CVSS 4.0 score of 8.5 is driven upward by subsequent-system (SC:H/SI:H/SA:H) metrics that our independent assessment considers inflated for a single embedded gateway; the practical risk is bounded by the PR:H administrative authentication prerequisite in the vector and by the fact that consumer smart-home management interfaces such as this are normally reachable only from the LAN.