Monthly
OS command injection in the FILESystem:MOUNT:DRIve SCPI command handler of Tektronix 3 Series MDO oscilloscopes running firmware before 1.21.1 allows authenticated, low-privileged attackers who can reach the instrument's remote-control interface to execute arbitrary operating system commands with elevated privileges (CVSS 8.8, CWE-78, PR:L/UI:N). Any 3 Series MDO that exposes its SCPI control interface (LAN/VXI-11 or raw socket) to a lab or engineering network is in scope, and the attack requires no user interaction. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied in the available data, so the realistic risk is concentrated on network-exposed instruments rather than mass exploitation.
OS command injection in ZoneMinder allows an authenticated user holding monitor-create or monitor-edit permission to execute arbitrary commands as the web server user by saving a Local-type monitor whose Device Path field contains shell metacharacters. The malicious stored Device value is later interpolated into shell commands in both Perl (qx()/backticks via zmdc.pl control paths and zmpkg.pl start/restart) and PHP (zmc daemon control helpers that relied on bypassable escapeshellcmd) when the monitor control or startup path runs. The issue is fixed in 1.39.2, 1.38.2, and 1.36.40, which reject any Device value not matching a strict /dev/ path pattern; no public exploit code has been identified at time of analysis, and exploitation is not confirmed actively exploited (KEV).
Remote command execution in ZoneMinder prior to 1.38.3 allows an authenticated user with monitor-create or monitor-edit rights to store a monitor Name containing shell metacharacters that break out of manual single-quote wrapping when a user with Events View permission exports that monitor's events, executing arbitrary commands as the web server user. Exploitation requires two authenticated roles and victim interaction (CVSS vector PR:L/UI:R), so this is not a default-reachable or mass-exploitable issue; no public exploit identified at time of analysis, and a vendor-released patch is available in 1.38.3.
Authenticated OS command injection in ZoneMinder versions prior to 1.38.3 allows a low-privilege user holding View Events or View Snapshots permission to run arbitrary operating system commands as the web server user. The flaw lives in exportEvents() in web/skins/classic/includes/export_functions.php, where the attacker-controlled exportFile request parameter is appended to a tar or zip command executed via exec() without shell escaping, so a crafted value can break out of the trailing directory argument. Exploitation requires a valid session (CVSS PR:L), a valid CSRF token for the export request, and the exportDetail option enabled; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), though the vendor's own GHSA advisory and fix commits confirm the issue is real and the EPSS-style risk is elevated by the low privilege threshold and high confidentiality, integrity, and availability impact (CVSS 8.8).
OS command injection in SparkyFitness versions prior to 1.6.0 allows an authenticated global administrator to execute arbitrary operating-system commands on the server by uploading a restore archive with a filename containing shell metacharacters. The vulnerability resides in the api/admin/backup/restore endpoint, which improperly interpolates the user-supplied filename into a shell command. Exploitation requires the highest-level application privilege (global admin), and no public exploit code has been identified at time of analysis. The issue is fixed in version 1.6.0.
Command injection (CWE-78) and stored XSS in Wheels CLI 4.0.0 through 4.1.1 allow an attacker who can influence inputs processed by the tool to run arbitrary shell commands as the SSH deploy user on deploy hosts and on the CI runner during builds. Deploy release/version/rollback values, package removal/destroy and extraction paths, and generator names are the primary injection surfaces, with unencoded scaffold 'show' views (since 4.1.0) and generated admin views permitting stored XSS; trigger inputs can come from CI variables, Git branch names, downloaded packages, or an AI agent using the CLI's MCP tools. The flaw is fixed in 4.1.2, and existing affected generated views also require a documented manual edit; no public exploit code has been identified at time of analysis.
Command injection in pfSense CE 2.7.0 through 2.9.0 allows authenticated users who hold only the Captive Portal HA privilege to execute commands as root by manipulating backwardsyncip to point at an attacker-controlled XMLRPC server and returning connected_users entries with shell metacharacters in ip or mac fields. Exploitation is privilege-gated: it requires the specific Captive Portal HA WebGUI permission, use of Captive Portal high-availability sync, and the ability to influence the synced connected_users data. Publicly available exploit code exists, but no CISA KEV confirmed active exploitation is identified; this is a credible privilege-gated priority rather than a mass-exploitation emergency.
Command injection in Netgate pfSense CE 2.4.5 through 2.9.0 lets an authenticated WebGUI user holding the Advanced Admin Access privilege execute arbitrary commands as root by placing newline or $(...) sequences in the Login Protection (sshguard) threshold, block time, or detection time fields, which are written unvalidated to sshguard.conf and sourced as root when the service restarts. The flaw is privilege-gated rather than mass-exploitable: the CVSS vector specifies PR:H, so only already-administrative accounts can trigger it, with no user interaction required beyond the attacker's own session. Publicly available exploit code exists (referenced in the CVE record), and the root cause is CWE-78 OS command injection.
Authenticated VPN users can execute arbitrary commands as root on pfSense CE through 2.9.0 by exploiting an OS command injection in the OpenVPN connect/disconnect script, openvpn.connect_async.sh. The attack requires a valid VPN account authenticated via RADIUS or LDAP and a username containing single quotes and shell metacharacters that break out of an eval'd pfctl anchor name. Publicly available exploit code exists (reported by VulnCheck), though no active exploitation has been confirmed by CISA KEV. This is a credible high-priority issue for any pfSense CE deployment that uses OpenVPN with external authentication.
OS command injection in Netgate pfSense CE 2.7.0 through 2.9.0 lets an authenticated web GUI user who holds the Traffic Shaper Limiters privilege execute arbitrary commands as root, turning a narrowly delegated configuration permission into full appliance compromise. The flaw is triggered when an operator edits a limiter and injects a crafted hidden 'number' value and then deletes that limiter, causing delete_queue() to pass the unquoted, attacker-controlled value to dnctl via /bin/sh running as root. Publicly available exploit code exists (VulnCheck advisory plus Abraxas Labs research and a PoC repository), and while the issue is not listed in CISA KEV as actively exploited, exploitation is gated on prior authenticated access with the Limiters privilege (PR:H) and on the attacker completing the limiter edit-then-delete workflow.
OS command injection in the FILESystem:MOUNT:DRIve SCPI command handler of Tektronix 3 Series MDO oscilloscopes running firmware before 1.21.1 allows authenticated, low-privileged attackers who can reach the instrument's remote-control interface to execute arbitrary operating system commands with elevated privileges (CVSS 8.8, CWE-78, PR:L/UI:N). Any 3 Series MDO that exposes its SCPI control interface (LAN/VXI-11 or raw socket) to a lab or engineering network is in scope, and the attack requires no user interaction. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied in the available data, so the realistic risk is concentrated on network-exposed instruments rather than mass exploitation.
OS command injection in ZoneMinder allows an authenticated user holding monitor-create or monitor-edit permission to execute arbitrary commands as the web server user by saving a Local-type monitor whose Device Path field contains shell metacharacters. The malicious stored Device value is later interpolated into shell commands in both Perl (qx()/backticks via zmdc.pl control paths and zmpkg.pl start/restart) and PHP (zmc daemon control helpers that relied on bypassable escapeshellcmd) when the monitor control or startup path runs. The issue is fixed in 1.39.2, 1.38.2, and 1.36.40, which reject any Device value not matching a strict /dev/ path pattern; no public exploit code has been identified at time of analysis, and exploitation is not confirmed actively exploited (KEV).
Remote command execution in ZoneMinder prior to 1.38.3 allows an authenticated user with monitor-create or monitor-edit rights to store a monitor Name containing shell metacharacters that break out of manual single-quote wrapping when a user with Events View permission exports that monitor's events, executing arbitrary commands as the web server user. Exploitation requires two authenticated roles and victim interaction (CVSS vector PR:L/UI:R), so this is not a default-reachable or mass-exploitable issue; no public exploit identified at time of analysis, and a vendor-released patch is available in 1.38.3.
Authenticated OS command injection in ZoneMinder versions prior to 1.38.3 allows a low-privilege user holding View Events or View Snapshots permission to run arbitrary operating system commands as the web server user. The flaw lives in exportEvents() in web/skins/classic/includes/export_functions.php, where the attacker-controlled exportFile request parameter is appended to a tar or zip command executed via exec() without shell escaping, so a crafted value can break out of the trailing directory argument. Exploitation requires a valid session (CVSS PR:L), a valid CSRF token for the export request, and the exportDetail option enabled; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), though the vendor's own GHSA advisory and fix commits confirm the issue is real and the EPSS-style risk is elevated by the low privilege threshold and high confidentiality, integrity, and availability impact (CVSS 8.8).
OS command injection in SparkyFitness versions prior to 1.6.0 allows an authenticated global administrator to execute arbitrary operating-system commands on the server by uploading a restore archive with a filename containing shell metacharacters. The vulnerability resides in the api/admin/backup/restore endpoint, which improperly interpolates the user-supplied filename into a shell command. Exploitation requires the highest-level application privilege (global admin), and no public exploit code has been identified at time of analysis. The issue is fixed in version 1.6.0.
Command injection (CWE-78) and stored XSS in Wheels CLI 4.0.0 through 4.1.1 allow an attacker who can influence inputs processed by the tool to run arbitrary shell commands as the SSH deploy user on deploy hosts and on the CI runner during builds. Deploy release/version/rollback values, package removal/destroy and extraction paths, and generator names are the primary injection surfaces, with unencoded scaffold 'show' views (since 4.1.0) and generated admin views permitting stored XSS; trigger inputs can come from CI variables, Git branch names, downloaded packages, or an AI agent using the CLI's MCP tools. The flaw is fixed in 4.1.2, and existing affected generated views also require a documented manual edit; no public exploit code has been identified at time of analysis.
Command injection in pfSense CE 2.7.0 through 2.9.0 allows authenticated users who hold only the Captive Portal HA privilege to execute commands as root by manipulating backwardsyncip to point at an attacker-controlled XMLRPC server and returning connected_users entries with shell metacharacters in ip or mac fields. Exploitation is privilege-gated: it requires the specific Captive Portal HA WebGUI permission, use of Captive Portal high-availability sync, and the ability to influence the synced connected_users data. Publicly available exploit code exists, but no CISA KEV confirmed active exploitation is identified; this is a credible privilege-gated priority rather than a mass-exploitation emergency.
Command injection in Netgate pfSense CE 2.4.5 through 2.9.0 lets an authenticated WebGUI user holding the Advanced Admin Access privilege execute arbitrary commands as root by placing newline or $(...) sequences in the Login Protection (sshguard) threshold, block time, or detection time fields, which are written unvalidated to sshguard.conf and sourced as root when the service restarts. The flaw is privilege-gated rather than mass-exploitable: the CVSS vector specifies PR:H, so only already-administrative accounts can trigger it, with no user interaction required beyond the attacker's own session. Publicly available exploit code exists (referenced in the CVE record), and the root cause is CWE-78 OS command injection.
Authenticated VPN users can execute arbitrary commands as root on pfSense CE through 2.9.0 by exploiting an OS command injection in the OpenVPN connect/disconnect script, openvpn.connect_async.sh. The attack requires a valid VPN account authenticated via RADIUS or LDAP and a username containing single quotes and shell metacharacters that break out of an eval'd pfctl anchor name. Publicly available exploit code exists (reported by VulnCheck), though no active exploitation has been confirmed by CISA KEV. This is a credible high-priority issue for any pfSense CE deployment that uses OpenVPN with external authentication.
OS command injection in Netgate pfSense CE 2.7.0 through 2.9.0 lets an authenticated web GUI user who holds the Traffic Shaper Limiters privilege execute arbitrary commands as root, turning a narrowly delegated configuration permission into full appliance compromise. The flaw is triggered when an operator edits a limiter and injects a crafted hidden 'number' value and then deletes that limiter, causing delete_queue() to pass the unquoted, attacker-controlled value to dnctl via /bin/sh running as root. Publicly available exploit code exists (VulnCheck advisory plus Abraxas Labs research and a PoC repository), and while the issue is not listed in CISA KEV as actively exploited, exploitation is gated on prior authenticated access with the Limiters privilege (PR:H) and on the attacker completing the limiter edit-then-delete workflow.