Command Injection
Monthly
Local privilege escalation in Akamai Guardicore Platform Agent 7.0-7.3.1 and Zero Trust Client 6.0-6.1.5 on Linux and macOS enables unprivileged users to gain root access through two distinct vectors: a TOCTOU race condition in the HandleSaveLogs() function that creates world-writable root-owned files via symlink manipulation in /tmp, and command injection in the gimmelogs diagnostic tool executing with root privileges. The vulnerability requires local access with high attack complexity (CVSS AC:H) but no authentication (PR:N), affecting endpoint security agents that typically run with elevated privileges. No active exploitation confirmed at time of analysis; EPSS data not available for this 2026 CVE identifier.
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root through unsanitized GET parameter. Exploitation requires Softaculous or SitePad components to be installed. Despite critical impact (root RCE), EPSS score of 6.16% (91st percentile) suggests selective targeting rather than mass exploitation, though technical barrier is low (AC:L). Public exploit code exists via Karma Insecurity disclosure and FullDisclosure mailing list, significantly increasing attack surface.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 60.2%.
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on the server via a crafted build parameter. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 32.4%.
Command injection in Azure Cloud Shell enables remote attackers to execute arbitrary commands and spoof user sessions when victims interact with malicious content. The vulnerability requires user interaction (UI:R) but no authentication (PR:N), allowing network-based attackers to achieve high impact across confidentiality, integrity, and availability with scope change (S:C), indicating potential container escape or cross-tenant impact. Microsoft has released a patch per MSRC advisory. EPSS data not available, no CISA KEV listing identified, suggesting targeted rather than widespread exploitation at time of analysis.
Remote unauthenticated command injection in Microsoft's Copilot Chat for Edge browser enables information disclosure via crafted network requests. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates attackers can exploit this remotely without authentication or user interaction, though impact is limited to confidentiality (C:H/I:N/A:N). Microsoft has released a patch per MSRC advisory. No active exploitation confirmed by CISA KEV at time of analysis, though the low attack complexity and lack of authentication requirements make this readily exploitable once technical details emerge.
Command injection in GitPython 3.1.30-3.1.46 allows remote authenticated attackers to execute arbitrary commands via underscore-formatted kwargs that bypass unsafe option validation. Applications passing attacker-controlled kwargs to Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push() are vulnerable even when allow_unsafe_options=False (default). GitHub-confirmed exploit with vendor-released patch 3.1.47. CVSS 8.8 reflects network vector with low complexity and authenticated access; no EPSS/KEV data indicates exploitation not yet widespread beyond proof-of-concept demonstration.
vm2 NodeVM with nesting:true silently overrides require:false, granting sandbox code unconditional access to require('vm2') and enabling remote code execution on the host via nested NodeVM construction. Applications running untrusted code in a NodeVM configured with {nesting:true, require:false} are fully compromised — attackers can execute arbitrary OS commands as the host process user. Publicly available exploit code exists (proof-of-concept demonstrated command execution via child_process). CVSS 9.1 indicates high privileges required (PR:H), meaning the host must explicitly enable nesting:true, but the severity reflects scope change (S:C) when this non-default configuration is present. Vendor-released patch in vm2 3.11.1 converts contradictory configuration into a runtime error at NodeVM construction time, preventing silent sandbox escape.
Unauthenticated remote code execution in Gotenberg 8.29.1 allows network attackers to execute arbitrary OS commands via newline injection in PDF metadata keys. The `/forms/pdfengines/metadata/write` endpoint passes user-controlled JSON metadata keys directly to ExifTool without control-character validation. Embedding `\n` in a key splits ExifTool's stdin stream, injecting arbitrary flags including `-if` which evaluates Perl expressions. Attack returns HTTP 200 with valid PDF output, evading basic monitoring. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects critical network-accessible RCE. No vendor-released patch identified at time of analysis — GitHub advisory GHSA-rqgh-gxv4-6657 confirms the issue but CPE data shows no fixed version. Publicly available exploit code exists in Python and bash with OOB exfiltration. Default Docker image `gotenberg/gotenberg:8` runs the vulnerable process as uid 1001 with root group membership, amplifying post-exploitation impact.
Command injection in Crestron Touchpanels (X60/X70 series) allows authenticated SSH users to execute arbitrary OS commands via control characters in a hidden console command's second argument. Discovered by Eugene Lim, this popen-based injection requires high privilege SSH access and high attack complexity. CVSS 7.4 with CVSS:4.0 metrics indicates network vector (AV:N) but requires high privileges (PR:H) and high complexity (AC:H), limiting real-world exploitation to scenarios where attackers have already compromised SSH credentials. Vendor patch available (firmware 3.003.0015.001). No active exploitation or public POC identified at time of analysis.
Remote command injection in EFM ipTIME C200 camera firmware (versions up to 1.092) allows authenticated administrators to execute arbitrary system commands via malicious file upload to the ApplyRestore endpoint. The vulnerability exists in the sub_408F90 function processing the RestoreFile parameter in /cgi/iux_set.cgi. Exploitation probability is elevated by publicly available proof-of-concept code demonstrating the attack technique, though no active exploitation has been confirmed by CISA KEV at time of analysis. Vendor has been unresponsive to disclosure attempts, indicating no official patch timeline.
Remote unauthenticated command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows attackers to execute arbitrary OS commands via the 'enable' parameter in the setAppFilterCfg function. Exploitation requires no authentication or user interaction, with a publicly available proof-of-concept exploit published on GitHub. CVSS 8.9 reflects critical impact across confidentiality, integrity, and availability, though EPSS data is unavailable to assess real-world exploitation probability. Not currently listed in CISA KEV, suggesting targeted rather than widespread exploitation at time of analysis.
Authenticated command injection in ALTICE LABS GR140DG and GR140IG fiber gateways allows remote attackers with valid credentials to execute arbitrary commands as root through the traceroute diagnostic handler. The vulnerability exists in the /bin/httpd_clientside component where unsanitized destAddr parameters are passed directly to system() calls, enabling shell command substitution attacks. With CVSS 8.8 (High) but EPSS exploitation probability of only 0.04% (12th percentile), this vulnerability affects widely-deployed ISP-managed CPE devices in France (SFR network) but shows no evidence of active exploitation or public POC availability at time of analysis.
Command injection in ALTICE LABS GR140DG and GR140IG fibre routers allows authenticated remote attackers to execute arbitrary commands as root. The ping diagnostic handler in /bin/httpd_clientside accepts unsanitized user input in the destAddr parameter and passes it to a system() call, enabling shell command substitution. SSVC indicates total technical impact with no confirmed exploitation; EPSS score of 0.04% (12th percentile) suggests low observed exploitation activity, though the availability of a detailed security advisory (XEROD-2026-0001) may increase attack surface awareness among threat actors.
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-STD.PROD-1 allows attackers to execute arbitrary system commands via the /action/SetRemoteAccessCfg endpoint in the GoAhead web server. CVSS 9.1 reflects critical impact with network-accessible attack vector requiring no authentication or user interaction. GitHub repository suggests publicly available exploit code exists (CVE-2026-36356), significantly lowering exploitation barrier for attackers targeting industrial IoT and cellular gateway deployments.
Remote code execution as root in nginx-ui versions before 2.3.8 via unauthenticated backup restore within 10-minute startup window. Attackers exploit the completely unauthenticated /api/restore endpoint during initial installation to upload malicious backup archives that overwrite app.ini configuration with injected OS commands in TestConfigCmd setting. After automatic application restart, command injection triggers with privileges of the nginx-ui process - typically root in Docker deployments. EPSS data not available; no active exploitation reported but publicly disclosed via GitHub Security Advisory GHSA-4pvg-prr3-9cxr. Patch released in version 2.3.8.
Remote unauthenticated command injection in WDR201A WiFi Extender (HW V2.1, FW ≤1.02) allows attackers to execute arbitrary OS commands with device privileges via five vulnerable firewall.cgi handlers without authentication. Injected commands persist in NVRAM and automatically re-execute on every subsequent firewall request, creating a self-sustaining backdoor. Public exploit code exists per VulnCheck, making this an immediate weaponization risk for exposed devices. CVSS 9.3 reflects network attack vector with no complexity or authentication barriers (AV:N/AC:L/PR:N), though real-world impact depends on whether management interfaces are internet-exposed.
Remote code execution in WDR201A WiFi Extender (HW V2.1, FW ≤1.02) allows unauthenticated attackers to execute arbitrary OS commands via the adm.cgi binary's reboot_time parameter. The vulnerability stems from unsanitized input handling in the reboot scheduling function, exploitable by sending crafted POST requests with shell metacharacters when reboot_enabled=1. Public exploit code exists (CVSS 9.3, SSVC: automatable/total impact), making this a critical priority for affected deployments despite no confirmed CISA KEV listing at time of analysis.
Remote code execution in WDR201A WiFi Extender (HW V2.1, FW ≤1.02) allows unauthenticated network attackers to execute arbitrary OS commands via the makeRequest.cgi binary. Exploitation requires no user interaction and has CVSS:4.0 score of 9.3. Publicly available exploit code exists (confirmed by VulnCheck and CISA SSVC framework), enabling automated attacks against exposed devices. SSVC designates this as automatable with total technical impact, representing immediate operational risk to internet-facing extenders.
OS command injection in WDR201A WiFi Extender firmware v1.02 allows unauthenticated remote attackers to execute arbitrary shell commands via the gateway parameter in internet.cgi. Exploitation requires no user interaction or authentication against internet-exposed devices. Public exploit code exists (VulnCheck advisory), demonstrating active security research interest. CVSS 9.3 reflects maximum network exploitability (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity, and availability impact on the device itself. No vendor patch identified at time of analysis for this discontinued consumer IoT product.
Remote code execution in WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) allows unauthenticated network attackers to execute arbitrary shell commands via OS command injection in the wireless.cgi binary. Attackers exploit unsanitized sz11gChannel or PIN POST parameters in set_wifi_basic and set_wifi_do_wps functions to achieve root-level code execution without authentication. Publicly available exploit code exists. CVSS v4.0 score of 9.3 reflects the critical nature: network-accessible, no complexity, no authentication required, with high confidentiality, integrity, and availability impact. SSVC assessment confirms POC availability, full automatable exploitation, and total technical impact-making this a high-priority remediation target despite no confirmed active exploitation (not CISA KEV-listed).
Remote code execution in Evolver versions before 1.69.3 allows unauthenticated network attackers to execute arbitrary shell commands via command injection in the _extractLLM() function. Attackers exploit unsanitized corpus parameters passed to execSync() through string concatenation in a curl command, achieving full system compromise. GitHub security advisory GHSA-j5w5-568x-rq53 confirms the vulnerability with proof-of-concept demonstrating shell command substitution bypass. CVSS score of 9.8 reflects no authentication or user interaction requirements. No CISA KEV listing or EPSS data provided, suggesting exploitation status remains uncertain beyond confirmed POC availability.
Remote code execution in SambaBox 5.1-5.2 allows authenticated administrators to inject and execute arbitrary OS commands through improper input sanitization. Attackers with high-privilege access can achieve full system compromise with confidentiality, integrity, and availability impact. Reported by Turkish national CERT (TR-CERT/USOM), no CISA KEV listing or public exploit code identified at time of analysis, indicating limited observed exploitation activity.
Authenticated OS command injection in the DdnsSetting.cgi handler of GeoVision GV-LPC2011/LPC2211 license plate capture cameras (firmware 1.10) lets an attacker with low-privilege access to the device web interface execute arbitrary OS commands by writing a crafted value into the DDNS configuration. CVSS scores the issue 8.8 (high) with full confidentiality, integrity, and availability impact, and Talos has published an advisory (TALOS-2025-2326); no public exploit identified at time of analysis and EPSS is low at 0.17%.
Command injection in Caesium Image Compressor (all versions through commit 02da2c6) allows local authenticated attackers to execute arbitrary OS commands via unsanitized input to shutdownMachine and putMachineToSleep functions in PostCompressionActions.cpp. The vulnerable code uses system() calls without input validation, enabling shell metacharacter injection during post-compression power management operations. Patch available via GitHub PR #376 replacing system() with QProcess::startDetached(). EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability. No evidence of active exploitation or public POC beyond the researcher's advisory.
Malicious code injection in Bitwarden CLI 2026.4.0 distributed via npm for 90 minutes on April 22, 2026, enables remote command execution without authentication. The compromise was part of a broader Checkmarx supply chain attack targeting the npm registry. Users who installed this specific version during the 21:57Z-23:30Z window received a backdoored package capable of executing arbitrary OS commands. EPSS data not available for this recent CVE, but the supply chain vector and brief exposure window suggest targeted rather than mass exploitation.
Command injection in Totolink NR1800X router firmware 9.1.0u.6279_B20210910 allows authenticated remote attackers to execute arbitrary system commands via the setUssd parameter in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (POC confirmed via GitHub). EPSS data not provided, but CVSS v4.0 base score of 7.4 with low attack complexity (AC:L) and network attack vector (AV:N) indicates moderate-to-high severity for internet-facing devices with default credentials or weak authentication.
OS command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'proto' parameter in /cgi-bin/cstecgi.cgi CGI handler. A public proof-of-concept exploit exists on GitHub, significantly lowering the barrier for exploitation. CVSS 8.9 with network vector, low complexity, and no authentication requirements makes this immediately exploitable against internet-facing devices running the vulnerable firmware version.
Remote code execution in HKUDS OpenHarness allows authenticated remote attackers to execute arbitrary operating system commands via the /bridge slash command. Attackers with remote sender privileges can invoke '/bridge spawn' with malicious command arguments that bypass input validation and execute directly through the shell subprocess helper, granting access to local files, credentials, workspace state, and repository contents. Vendor-released patch available (commit 438e373) that restricts /bridge to local-only invocation by default.
Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to execute arbitrary shell commands with SYSTEM privileges on the underlying host. The vulnerability exists in the FSx Windows File Server volume mounting component (versions prior to 1.103.0), where username field input is not properly sanitized before being passed to OS commands. This affects AWS customers running Windows-based ECS container workloads with FSx volumes - exploitation requires IAM permissions to register ECS task definitions or write to credential stores (Secrets Manager/SSM Parameter Store) used by FSx configurations. Vendor-released patch: version 1.103.0. EPSS and KEV data not provided; no public exploit identified at time of analysis.
Command injection in Pallets Click's click.edit() function (versions ≤8.3.2) allows local attackers with high privileges to execute arbitrary OS commands via shell metacharacters. The vulnerability stems from unsafe use of shell=True in subprocess calls, fixed in version 8.3.3 by switching to shlex.split for command parsing. Attack complexity is high (AC:H) and requires user interaction (UI:R), limiting real-world exploitation despite CVSS 7.2 score. Public proof-of-concept exists (SSVC: exploitation=poc) but no evidence of active exploitation (not in CISA KEV). EPSS data not provided but expected low given local-only access vector and multiple exploitation constraints.
Remote code execution in DocsGPT 0.15.0 through 0.16.0 (exclusive) lets an attacker reach the application's 'MCP test' function and submit a crafted payload that bypasses its validation to run arbitrary commands on the host. Because the hosted arc53 DocsGPT site and any local or public self-hosted deployment expose the same code path, exploitation requires no authentication or user interaction (CVSS 4.0 base 10.0, CWE-77 command injection). Publicly available exploit code exists per SSVC, though EPSS remains low at 0.29% and it is not listed in CISA KEV.
OS command injection in Pardus OS "My Computer" (versions up to and including 0.7.5, fixed in 0.8.0) lets an attacker execute arbitrary operating-system commands when a victim interacts with attacker-controlled input, inheriting the privileges of the file-manager process. Reported by Turkey's national CERT (TR-CERT) with a vendor patch available; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.10%).
Remote unauthenticated command injection in TOTOLINK N200RE V5 router allows complete device compromise via formMapDelDevice function. Attackers can execute arbitrary OS commands by injecting malicious payloads into the macstr or bandstr parameters with no authentication required (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Public proof-of-concept code exists per SSVC framework (exploitation: poc), making this immediately weaponizable against internet-facing devices. EPSS data unavailable, but CVSS vector and POC availability indicate critical real-world risk for consumer routers with default configurations exposed to the internet.
Remote unauthenticated command injection in Totolink A8000RU 7.1cu.643_b20200521 allows complete device compromise via crafted requests to the WiFi Guest Configuration CGI handler. Attackers can inject arbitrary OS commands through the 'merge' parameter in setWiFiEasyGuestCfg function at /cgi-bin/cstecgi.cgi, achieving full system control without authentication. Public exploit code exists (confirmed by CVSS E:P and GitHub POC reference), significantly lowering the barrier to exploitation. EPSS data not available, but the combination of network attack vector, no authentication requirement, low complexity, and publicly available exploit indicates elevated real-world risk for internet-facing devices.
Remote unauthenticated command injection in Totolink A8000RU 7.1cu.643_b20200521 allows attackers to execute arbitrary OS commands via the maxRtrAdvInterval parameter in the setRadvdCfg function of /cgi-bin/cstecgi.cgi. Public exploit code exists per VulDB submission, enabling immediate weaponization against exposed devices. CVSS 8.9 reflects network accessibility, no authentication requirement, and high impact across confidentiality, integrity, and availability - attack complexity is low with no user interaction needed, making this a critical priority for internet-facing Totolink routers.
OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows unauthenticated remote attackers to execute arbitrary system commands via the setOpenVpnClientCfg function in /cgi-bin/cstecgi.cgi by manipulating the 'enabled' parameter. Public exploit code exists (disclosed on GitHub), significantly lowering the barrier to exploitation. CVSS 8.9 reflects the complete compromise potential (confidentiality, integrity, availability) without requiring authentication or user interaction, making this a critical exposure for deployed devices.
Remote command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 allows unauthenticated attackers to execute arbitrary OS commands via the wifiOff parameter in setWiFiBasicCfg function. The vulnerability has a publicly available exploit (PoC on GitHub) and achieves full system compromise with network-accessible attack vector requiring no authentication or user interaction. EPSS data not available, but CVSS 8.9 (Critical) with exploitability confirmed (E:P) indicates immediate patching priority for exposed devices.
OS command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the User parameter in the setVpnAccountCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (GitHub POC), enabling immediate weaponization. CVSS 8.9 with full impact on confidentiality, integrity, and availability. EPSS data unavailable; not currently in CISA KEV, but the combination of network accessibility, no authentication requirement, and public exploit makes this a critical risk for internet-facing devices.
Command injection in Zyxel DX3301-T0 and EX3301-T0 routers allows authenticated administrators to execute arbitrary OS commands by injecting malicious input into the DomainName parameter of DHCP configuration. Affects firmware versions through 5.50(ABVY.7.1)C0. Vendor Zyxel has published a security advisory with remediation guidance. EPSS data not available; no public exploit identified at time of analysis. While CVSS score is 7.2 (High), practical risk is constrained by requirement for admin-level authentication, limiting exposure to credential compromise or malicious insider scenarios.
Remote command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows unauthenticated attackers to execute arbitrary OS commands via the 'enable' parameter in setPptpServerCfg function of /cgi-bin/cstecgi.cgi. Public exploit code exists (GitHub POC available), enabling trivial remote compromise without authentication or user interaction. CVSS v4.0 score of 8.9 reflects maximum impact on confidentiality, integrity, and availability. No EPSS data or CISA KEV status available, but publicly documented POC substantially lowers exploitation barrier for this home/small office router platform.
Remote command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows unauthenticated attackers to execute arbitrary OS commands with router privileges via the setUrlFilterRules CGI function. Public exploit code exists (CVSS:4.0 E:P indicator), significantly increasing exploitation risk. EPSS data unavailable, but network-accessible command injection with public POC represents critical risk for internet-exposed devices.
OS command injection in Totolink A8000RU router firmware version 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands with root privileges via the wscDisabled parameter in the setWiFiWpsStart function of /cgi-bin/cstecgi.cgi. Public exploit code exists (VulDB #359802), enabling trivial weaponization. EPSS score unavailable; CVSS 8.9 reflects network-based unauthenticated attack with complete device compromise. No CISA KEV listing at time of analysis, suggesting targeted rather than mass exploitation.
Command injection in Milesight camera web servers allows authenticated administrators with user interaction to execute arbitrary operating system commands. CISA ICS-CERT issued an advisory (ICSA-26-113-03), indicating operational technology/critical infrastructure relevance. Successful exploitation achieves complete compromise of camera confidentiality and integrity. Attack requires privileged credentials (admin-level) and user interaction, significantly limiting real-world exploitation scenarios compared to unauthenticated remote attacks.
Command injection in the Tenda HG3 2.0 gateway/router allows an authenticated remote attacker to inject arbitrary OS commands through the formTracert handler at /boaform/formTracert by manipulating the datasize argument (CWE-77). Publicly available exploit code exists (disclosed via VulDB), though there is no public exploit identified as being actively used in the wild and it is not listed in CISA KEV. EPSS is modest at 0.29% (52nd percentile), indicating exploitation is plausible but not yet widespread.
OS command injection in TOTOLINK A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating-system commands via the CsteSystem function in /cgi-bin/cstecgi.cgi. Attacker-controlled input passed through the CGI Handler's HTTP argument is concatenated into a system command without sanitization. Publicly available exploit code exists (SSVC exploitation status: poc); there is no public exploit identified as being used in active attacks, and EPSS is modest at 0.89% (76th percentile).
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote attackers execute arbitrary shell commands by injecting into the admpass argument of the setLoginPasswordCfg function in /cgi-bin/cstecgi.cgi. The CGI Handler passes attacker-controlled input to a system shell without sanitization, granting full device compromise. Publicly available exploit code exists (disclosed via VulDB/GitHub); no active exploitation is confirmed in CISA KEV, and EPSS is modest at 0.89% (76th percentile).
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary system commands by manipulating the tty_server argument passed to the setAdvancedInfoShow function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists and the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation yielding full confidentiality, integrity, and availability impact. EPSS is currently low (0.89%, 76th percentile) and there is no public exploit identified as being actively used in the wild per CISA KEV.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the sys_info argument passed to the setMiniuiHomeInfoShow function of /cgi-bin/cstecgi.cgi. Per the CVSS vector the attack is network-based with no privileges or user interaction required (PR:N/UI:N), and publicly available exploit code exists (published via VulDB/GitHub), though it is not listed in CISA KEV. EPSS is low at 0.89% (76th percentile), suggesting exploitation is plausible but not yet widespread.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to inject arbitrary operating-system commands through the telnet_enabled argument of the setTelnetCfg function in /cgi-bin/cstecgi.cgi. The flaw carries a CVSS 4.0 score of 8.9 with high impact to confidentiality, integrity, and availability, and publicly available exploit code exists, though it is not listed in CISA KEV. EPSS is modest at 0.89% (76th percentile), indicating publicly available exploit code exists but no confirmation of widespread active exploitation.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the HTTP argument processed by the CsteSystem function in /cgi-bin/cstecgi.cgi. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists and a POC has been disclosed; there is no public exploit identified as actively exploited in the wild (not on CISA KEV), and EPSS is low at 0.89%.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote, unauthenticated attackers execute arbitrary shell commands by manipulating the 'mode' parameter passed to the setWiFiAclRules function in the /cgi-bin/cstecgi.cgi CGI handler. Publicly available exploit code exists (VulDB) and SSVC rates it automatable with total technical impact, though EPSS remains modest at 0.89% (76th percentile) and it is not listed in CISA KEV. With CVSS 4.0 of 8.9 and no authentication required, any attacker reaching the device's web interface can gain full control.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote unauthenticated attackers execute arbitrary system commands by manipulating the 'tz' parameter of the setNtpCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (published via VulDB), and the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, total impact) reflects unauthenticated network reachability with full compromise, though EPSS remains modest at 0.89%. This is no public exploit identified as actively exploited - there is no CISA KEV listing at time of analysis.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the sambaEnabled argument passed to the setStorageCfg function in /cgi-bin/cstecgi.cgi. The CVSS 4.0 vector indicates network-reachable, unauthenticated exploitation (AV:N/PR:N/UI:N) with total impact on confidentiality, integrity, and availability. Publicly available exploit code exists (VulDB), though EPSS remains modest at 0.89% (76th percentile) and it is not listed in CISA KEV.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote attackers inject arbitrary operating-system commands through the wanIdx argument of the setDmzCfg handler in /cgi-bin/cstecgi.cgi. The CGI Handler passes attacker-controlled input into a shell context without sanitization, yielding full command execution on the device. Publicly available exploit code exists and the SSVC framework rates technical impact as total and the attack as automatable, though it is not listed in CISA KEV and EPSS remains modest at 0.89%.
OS command injection in Totolink A8000RU 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'merge' parameter in the setWiFiEasyCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists on GitHub (Litengzheng/vuldb_new2), enabling trivial exploitation against internet-facing devices. CVSS 8.9 reflects network attack vector with no authentication required (AV:N/PR:N), and EPSS data suggests moderate real-world exploitation probability given the POC availability and low attack complexity.
OS command injection in Totolink A8000RU 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via crafted addrPrefixLen parameter to the setIpv6LanCfg function in /cgi-bin/cstecgi.cgi. CVSS 8.9 (High) with CVSS:4.0 vector indicating network-accessible, low-complexity attack requiring no privileges or user interaction. Publicly available exploit code exists (GitHub POC), enabling weaponization by threat actors. Not currently listed in CISA KEV, suggesting limited observed exploitation despite public disclosure and high severity scoring.
OS command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'enable' parameter in the setUPnPCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (POC confirmed), increasing immediate risk for exposed devices. EPSS data not available, but CVSS 8.9 with network vector (AV:N), no authentication (PR:N), and low complexity (AC:L) indicates trivial remote exploitation against default configurations.
OS command injection in Totolink A8000RU 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'wizard' parameter in the setWizardCfg function of /cgi-bin/cstecgi.cgi. Public exploit code exists (CVSS E:P), significantly lowering the barrier to exploitation. EPSS data not available, but the combination of network attack vector (AV:N), no authentication (PR:N), low complexity (AC:L), and published POC indicates elevated real-world risk for internet-exposed devices.
OS command injection in Tenda HG3 router version 2.0 allows authenticated remote attackers to execute arbitrary commands with device privileges via the 'countrystr' parameter in /boaform/formCountrystr endpoint. Public exploit code exists (CVSS 4.0 E:P modifier confirms POC availability), enabling authenticated attackers to fully compromise router confidentiality, integrity, and availability. EPSS data unavailable; not currently in CISA KEV catalog, suggesting exploitation may be targeted rather than widespread despite public POC.
OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the setIptvCfg parameter in /cgi-bin/cstecgi.cgi. CVSS 8.9 (Critical) with network attack vector and no authentication required. Public exploit code available on GitHub since disclosure, significantly lowering exploitation barrier for attackers targeting internet-facing consumer routers. No vendor patch identified for this end-of-life device at time of analysis.
Remote code execution in Apache Camel's camel-coap component (versions 4.14.0-4.14.5, 4.18.0 before 4.18.1, and 4.19.0) allows an unauthenticated attacker to inject arbitrary internal Camel headers via CoAP URI query parameters, achieving OS command execution when a route forwards to a header-sensitive producer such as camel-exec. The component maps incoming CoAP query parameters straight into Exchange message headers with no HeaderFilterStrategy, so a single UDP packet to port 5683 can override the executable and arguments of a downstream exec producer and return command output in the CoAP response. Rated CVSS 10.0 with publicly available exploit code, though EPSS remains modest (0.55%, 68th percentile) and CISA SSVC records no observed exploitation, indicating opportunity rather than confirmed mass exploitation.
OS command injection in Tenda HG3 router version 2.0 (build 300003070) allows authenticated remote attackers to execute arbitrary system commands with router privileges via the fmgpon_loid parameter in the formgponConf administrative function. Public exploit code is available and confirmed usable for attacks per VulDB reporting, significantly lowering the skill barrier for exploitation despite requiring valid administrative credentials.
Command injection in LogonTracer versions prior to 2.0.0 allows authenticated users to execute arbitrary OS commands on the server. LogonTracer, a JPCERT/CC-developed log analysis tool for investigating lateral movement in Windows Active Directory environments, contains an insufficiently sanitized input handler that permits shell command injection. Authentication is required (PR:L), but once logged in, attackers can achieve complete system compromise with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). No active exploitation confirmed at time of analysis, though the CVSS 4.0 score of 8.7 and low attack complexity (AC:L) indicate significant risk for organizations running vulnerable versions.
Remote unauthenticated command injection in Tenda AC18 router firmware V15.03.05.05_multi allows complete device compromise via the SetSambaCfg interface. Attackers can execute arbitrary system commands by manipulating the guestuser parameter in HTTP requests to /goform/SetSambaCfg. CVSS 9.8 critical severity with network attack vector and no authentication required. EPSS score of 0.06% (19th percentile) suggests low observed exploitation despite extreme technical severity. Publicly documented exploit proof-of-concept exists on GitHub.
Command injection in leonvanzyl's autocoder (development snapshot commit 79d02a) lets remote, unauthenticated attackers achieve arbitrary code execution by supplying a crafted 'command' parameter to the /devserver/start endpoint, which passes attacker input to a shell. The CVSS 9.8 score reflects network-reachable, no-authentication exploitation with total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, though CISA's SSVC framework rates it as automatable with total technical impact; EPSS is low at 0.27% (50th percentile).
Command injection in ssh-mcp versions up to 1.5.0 allows authenticated local users to execute arbitrary OS commands via the Description parameter to the shell.write function in src/index.ts. Publicly available exploit code exists (GitHub issue #44) demonstrating the vulnerability. Despite CVSS 7.1 severity, real-world risk is moderate due to local-only attack vector and low EPSS score (0.06%, 18th percentile), indicating minimal observed exploitation attempts. Vendor has not responded to early disclosure via issue report.
OS command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 enables remote unauthenticated attackers to execute arbitrary system commands via the pptpPassThru parameter in the setVpnPassCfg function. Public exploit code exists on GitHub, dramatically lowering the barrier to exploitation. CVSS v4.0 base score of 8.9 reflects network attack vector, low complexity, and no authentication requirements, with high impact to confidentiality, integrity, and availability of the vulnerable device.
OS command injection in Linksys MR9600 router firmware 2.0.6.206937 allows authenticated administrators to execute arbitrary system commands via crafted 'pin' parameter to the BTRequestGetSmartConnectStatus JNAP action handler. Publicly available exploit code exists (CVSS E:P), enabling remote compromise of router with full system-level access. Vendor notified but unresponsive, leaving users without confirmed patch. EPSS data not available; CVSS 7.3 severity reflects high impact limited by high privilege requirement (PR:H).
Remote code execution in electerm's npm install script allows unauthenticated attackers to execute arbitrary system commands on Linux systems during package installation. The install.js script unsafely concatenates attacker-controlled version strings from the project's update server directly into an 'rm -rf' command, enabling command injection. This critically affects users installing electerm via 'npm install -g electerm' on Linux, as a compromised update server or man-in-the-middle attacker could inject malicious commands during the installation process. The vulnerability has been patched in commit 59708b38c8, and the fixed version is already published to npm.
Authenticated local users can execute arbitrary code on Windows, macOS, and Linux via HTML injection in SiYuan desktop notification messages through version 3.6.4. The Electron-based desktop application mishandles notification rendering with unsafe settings (nodeIntegration enabled, contextIsolation disabled, webSecurity disabled), escalating XSS to full system compromise. Vendor-released patch available in version 3.6.5. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
Command injection in Roxy-WI versions prior to 8.2.6.4 enables authenticated attackers to execute arbitrary OS commands with sudo privileges on managed servers. The vulnerability stems from unsanitized input in the /config/<service>/find-in-config endpoint that breaks out of grep command context during remote SSH execution. A proof-of-concept exploit exists (CVSS E:P), and the CVSS 4.0 score of 7.4 reflects network-based attack with low complexity requiring only low-privilege authentication. Vendor-released patch 8.2.6.4 available via GitHub commit 02f147d.
Remote code execution in OpenLearnX (npm package openlearnx) before 2.0.3 lets an authenticated low-privilege user escape the Python code-execution sandbox and run arbitrary OS commands on the host. Because submitting code to the compiler/execution environment is the platform's intended feature, any user with access to that endpoint can weaponize it. Classified CWE-78 (OS command injection); no public exploit identified at time of analysis, EPSS 0.41% (61th percentile), and the flaw is fixed in 2.0.3.
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering framework to LLM agents) versions 1.6.0 and earlier lets remote, unauthenticated attackers achieve full remote code execution on the host. Attacker-controlled JSON-RPC parameters flow into r2_cmd_str() where shell metacharacters bypass the command filter, and because the fix re-enables radare2's exec/socket sandbox, the flaw effectively granted attackers direct shell access. Publicly available exploit code exists (reported by VulnCheck, POC referenced in issue #45); it is not listed in CISA KEV and EPSS is modest at 0.27% (51st percentile).
Remote code execution in FlowiseAI Flowise before 3.1.0 lets an unauthenticated attacker run arbitrary OS commands on the server via the Airtable Agent node. Because LLM-generated Python is executed without proper sandboxing, an attacker who can send prompts to a chatflow containing this node can use prompt injection to coerce the model into emitting malicious Python that runs in the context of the Flowise process. Reported through Trend Micro ZDI (ZDI-CAN-29412); publicly available exploit code exists (SSVC: PoC), though EPSS is low at 0.06% and it is not listed in CISA KEV.
Command injection in elFinder before 2.1.67 lets attackers reach OS command execution as the web server user through the resize command's bg (background color) parameter. When the file manager is configured with the ImageMagick CLI backend, the user-supplied bg value is interpolated into shell command strings without sufficient escaping, allowing shell metacharacter injection. Fixed in 2.1.67; no public exploit is identified at time of analysis, though the CVSS 4.0 threat metric E:P indicates proof-of-concept maturity, EPSS is low (0.44%), and it is not in CISA KEV.
Authenticated remote code execution in FlowiseAI Flowise (and the flowise-components package) prior to 3.1.0 arises from the CSVAgent node, which interpolates a user-supplied 'customReadCSV' Pandas string directly into Python code executed via pyodide. An authenticated attacker (or an unauthenticated one when FLOWISE_USERNAME/FLOWISE_PASSWORD are unset, via the 'x-request-from: internal' header bypass) can inject Python such as 'import os;os.system(...)' to run arbitrary commands on the server. Publicly available exploit code exists (PoC in the GHSA advisory); this is not listed in CISA KEV, and EPSS is modest at 0.62% (70th percentile).
Command injection in Paperclip @paperclipai/server (versions <2026.416.0) allows authenticated agents to execute arbitrary OS commands on the server host. Attackers with Agent API credentials can escalate from agent runtime to full server host control by injecting malicious shell commands through the adapterConfig.workspaceStrategy.provisionCommand field during workspace provisioning. CVSS 8.8 (high) with network-accessible attack vector and low complexity. Vendor patch available in version 2026.416.0. No public exploit or CISA KEV listing identified at time of analysis, but the vulnerability breaks critical trust boundaries in multi-agent AI orchestration systems.
Remote code execution in IBM Total Storage Service Console (TSSC) and TS4500 IMC versions 9.2 through 9.6 allows unauthenticated attackers to execute arbitrary commands with normal user privileges via improper input validation. The vulnerability carries a CVSS score of 7.3 with network attack vector and low complexity (AV:N/AC:L/PR:N/UI:N), enabling remote exploitation without authentication. No public exploit identified at time of analysis, and EPSS risk data is not available for this 2026 CVE.
Command injection in the TOTOLINK A3300R router (firmware v17.0.0cu.557_B20221024) lets remote attackers execute arbitrary OS commands by injecting into the stunEnable parameter of the /cgi-bin/cstecgi.cgi endpoint. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with total confidentiality, integrity, and availability impact, and publicly available exploit code exists via a GitHub PoC. Despite the 9.8 rating, EPSS is only 0.06% (19th percentile), and there is no CISA KEV listing, so no active exploitation is confirmed.
OS command injection in the TOTOLINK A3300R router firmware (v17.0.0cu.557_B20221024) lets remote attackers run arbitrary system commands by injecting shell metacharacters into the stunMaxAlive parameter handled by the /cgi-bin/cstecgi.cgi endpoint. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes unauthenticated network exploitation with total confidentiality, integrity, and availability impact, effectively granting full control of the device. Publicly available exploit code exists (GitHub PoC), though EPSS is very low (0.06%) and it is not listed in CISA KEV, so exploitation is proof-of-concept rather than confirmed in-the-wild.
OS command injection in TOTOLINK A3300R routers (firmware v17.0.0cu.557_B20221024) lets remote attackers run arbitrary commands by injecting shell metacharacters into the stunServerAddr parameter of the /cgi-bin/cstecgi.cgi endpoint. The flaw carries CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly available exploit code exists, though EPSS remains low at 0.06% and it is not listed in CISA KEV.
OS command injection in the TOTOLINK A3300R router (firmware v17.0.0cu.557_B20221024) lets remote attackers run arbitrary shell commands by injecting into the stunMinAlive parameter of the /cgi-bin/cstecgi.cgi endpoint. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 Critical with no authentication qualifier indicated, and CISA's SSVC framework marks it automatable with total technical impact. Publicly available exploit code exists (researcher writeup on GitHub), though EPSS remains very low at 0.06% and it is not on the CISA KEV list - no public exploit indicates active exploitation yet.
Command injection in radare2 PDB parser (versions before 6.1.4) enables arbitrary OS command execution when users analyze malicious PDB files. Publicly available exploit code exists. Attackers craft PDB files with newline characters in symbol names to inject radare2 commands during flag renaming operations, which then execute OS commands via radare2's shell operator when victims run the 'idp' command. CVSS 8.4 reflects local attack vector requiring user interaction, though EPSS data not available. Patch released in version 6.1.4 with detailed technical disclosure at blog.calif.io showing 0-day discovery process.
SQL injection in NocoBase's @nocobase/database package allows authenticated users with record-creation privileges to execute arbitrary SQL queries and extract database credentials. The vulnerability exists in the queryParentSQL() function, which constructs recursive Common Table Expression (CTE) queries using string concatenation instead of parameterized queries when processing tree collections with string primary keys. An attacker can inject malicious SQL by creating records with crafted primary key values, triggering the vulnerability when recursive eager loading occurs. Successful exploitation leads to full database compromise, with confirmed extraction of administrator credentials (emails and password hashes) in testing against PostgreSQL. On databases where the service account has elevated privileges, attackers can achieve operating system command execution via PostgreSQL's COPY...TO PROGRAM feature. Vendor patch available via GitHub PR #9133.
Remote code execution via unauthenticated command injection in rclone's remote control API allows network attackers to execute arbitrary commands on the host system through a single HTTP request. The vulnerability affects rclone deployments with the RC API enabled (--rc or rclone rcd) that are network-accessible and lack global HTTP authentication. An attacker exploits the unprotected operations/fsinfo endpoint by crafting a WebDAV backend definition with a malicious bearer_token_command parameter, which executes during backend initialization. Confirmed exploitable on master branch (commit bf55d5e6) and release v1.73.4 with public proof-of-concept available. CVSS 9.2 reflects critical severity with network attack vector and no authentication required, though exploitation requires specific deployment configuration (AT:P). No CISA KEV listing or EPSS data available at time of analysis.
OS command injection in GitHub Enterprise Server (all releases prior to 3.21) lets an authenticated Management Console administrator run arbitrary shell commands on the underlying appliance by embedding shell metacharacters in proxy configuration fields such as http_proxy. The flaw was reported through the GitHub Bug Bounty program and there is no public exploit identified at time of analysis; EPSS is negligible (0.01%, 3rd percentile) and CISA SSVC rates exploitation as none. Because it requires high-privilege console access, it is primarily a privilege-boundary escape from Management Console admin to full OS-level control rather than a remotely reachable pre-auth issue.
Remote code execution in AVideo versions 29.0 and below allows unauthenticated attackers to execute arbitrary shell commands on the server via command injection in the CloneSite plugin's cloneServer.json.php endpoint. Attackers exploit unsanitized user input in the 'url' parameter that gets directly concatenated into a wget command executed through PHP's exec() function. With CVSS 8.9 (AV:N/AC:L/PR:N/UI:N) and proof-of-concept exploitation confirmed (E:P), this represents a critical risk requiring immediate patching. Fix available in commit 473c609fc2defdea8b937b00e86ce88eba1f15bb.
Remote code execution in WWBN AVideo up to version 29.0 allows unauthenticated attackers to execute arbitrary system commands via unsanitized URL parameters in test.php. This vulnerability stems from an incomplete fix that sanitized wget calls but left file_get_contents and curl code paths exploitable through regex bypass (accepting strings like 'httpevil[.]com'). CVSS 9.3 with Critical scope change reflects the severity. Upstream fix available in commit 78bccae but no tagged release version confirmed at time of analysis. EPSS data not provided; no CISA KEV listing identified.
Command injection in Tenda W30E V2.0 firmware V16.01.0.21 allows remote unauthenticated attackers to execute arbitrary operating system commands as root through the formSetUSBPartitionUmount function by manipulating the usbPartitionName parameter. The vulnerability achieves maximum CVSS severity (9.8) due to network accessibility without authentication, though EPSS exploitation probability remains low (0.17%, 38th percentile), suggesting limited attacker interest at time of analysis. No active exploitation confirmed by CISA KEV, and public exploit code status is unverified from researcher disclosure.
Local privilege escalation in Akamai Guardicore Platform Agent 7.0-7.3.1 and Zero Trust Client 6.0-6.1.5 on Linux and macOS enables unprivileged users to gain root access through two distinct vectors: a TOCTOU race condition in the HandleSaveLogs() function that creates world-writable root-owned files via symlink manipulation in /tmp, and command injection in the gimmelogs diagnostic tool executing with root privileges. The vulnerability requires local access with high attack complexity (CVSS AC:H) but no authentication (PR:N), affecting endpoint security agents that typically run with elevated privileges. No active exploitation confirmed at time of analysis; EPSS data not available for this 2026 CVE identifier.
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root through unsanitized GET parameter. Exploitation requires Softaculous or SitePad components to be installed. Despite critical impact (root RCE), EPSS score of 6.16% (91st percentile) suggests selective targeting rather than mass exploitation, though technical barrier is low (AC:L). Public exploit code exists via Karma Insecurity disclosure and FullDisclosure mailing list, significantly increasing attack surface.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 60.2%.
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on the server via a crafted build parameter. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 32.4%.
Command injection in Azure Cloud Shell enables remote attackers to execute arbitrary commands and spoof user sessions when victims interact with malicious content. The vulnerability requires user interaction (UI:R) but no authentication (PR:N), allowing network-based attackers to achieve high impact across confidentiality, integrity, and availability with scope change (S:C), indicating potential container escape or cross-tenant impact. Microsoft has released a patch per MSRC advisory. EPSS data not available, no CISA KEV listing identified, suggesting targeted rather than widespread exploitation at time of analysis.
Remote unauthenticated command injection in Microsoft's Copilot Chat for Edge browser enables information disclosure via crafted network requests. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates attackers can exploit this remotely without authentication or user interaction, though impact is limited to confidentiality (C:H/I:N/A:N). Microsoft has released a patch per MSRC advisory. No active exploitation confirmed by CISA KEV at time of analysis, though the low attack complexity and lack of authentication requirements make this readily exploitable once technical details emerge.
Command injection in GitPython 3.1.30-3.1.46 allows remote authenticated attackers to execute arbitrary commands via underscore-formatted kwargs that bypass unsafe option validation. Applications passing attacker-controlled kwargs to Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push() are vulnerable even when allow_unsafe_options=False (default). GitHub-confirmed exploit with vendor-released patch 3.1.47. CVSS 8.8 reflects network vector with low complexity and authenticated access; no EPSS/KEV data indicates exploitation not yet widespread beyond proof-of-concept demonstration.
vm2 NodeVM with nesting:true silently overrides require:false, granting sandbox code unconditional access to require('vm2') and enabling remote code execution on the host via nested NodeVM construction. Applications running untrusted code in a NodeVM configured with {nesting:true, require:false} are fully compromised — attackers can execute arbitrary OS commands as the host process user. Publicly available exploit code exists (proof-of-concept demonstrated command execution via child_process). CVSS 9.1 indicates high privileges required (PR:H), meaning the host must explicitly enable nesting:true, but the severity reflects scope change (S:C) when this non-default configuration is present. Vendor-released patch in vm2 3.11.1 converts contradictory configuration into a runtime error at NodeVM construction time, preventing silent sandbox escape.
Unauthenticated remote code execution in Gotenberg 8.29.1 allows network attackers to execute arbitrary OS commands via newline injection in PDF metadata keys. The `/forms/pdfengines/metadata/write` endpoint passes user-controlled JSON metadata keys directly to ExifTool without control-character validation. Embedding `\n` in a key splits ExifTool's stdin stream, injecting arbitrary flags including `-if` which evaluates Perl expressions. Attack returns HTTP 200 with valid PDF output, evading basic monitoring. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects critical network-accessible RCE. No vendor-released patch identified at time of analysis — GitHub advisory GHSA-rqgh-gxv4-6657 confirms the issue but CPE data shows no fixed version. Publicly available exploit code exists in Python and bash with OOB exfiltration. Default Docker image `gotenberg/gotenberg:8` runs the vulnerable process as uid 1001 with root group membership, amplifying post-exploitation impact.
Command injection in Crestron Touchpanels (X60/X70 series) allows authenticated SSH users to execute arbitrary OS commands via control characters in a hidden console command's second argument. Discovered by Eugene Lim, this popen-based injection requires high privilege SSH access and high attack complexity. CVSS 7.4 with CVSS:4.0 metrics indicates network vector (AV:N) but requires high privileges (PR:H) and high complexity (AC:H), limiting real-world exploitation to scenarios where attackers have already compromised SSH credentials. Vendor patch available (firmware 3.003.0015.001). No active exploitation or public POC identified at time of analysis.
Remote command injection in EFM ipTIME C200 camera firmware (versions up to 1.092) allows authenticated administrators to execute arbitrary system commands via malicious file upload to the ApplyRestore endpoint. The vulnerability exists in the sub_408F90 function processing the RestoreFile parameter in /cgi/iux_set.cgi. Exploitation probability is elevated by publicly available proof-of-concept code demonstrating the attack technique, though no active exploitation has been confirmed by CISA KEV at time of analysis. Vendor has been unresponsive to disclosure attempts, indicating no official patch timeline.
Remote unauthenticated command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows attackers to execute arbitrary OS commands via the 'enable' parameter in the setAppFilterCfg function. Exploitation requires no authentication or user interaction, with a publicly available proof-of-concept exploit published on GitHub. CVSS 8.9 reflects critical impact across confidentiality, integrity, and availability, though EPSS data is unavailable to assess real-world exploitation probability. Not currently listed in CISA KEV, suggesting targeted rather than widespread exploitation at time of analysis.
Authenticated command injection in ALTICE LABS GR140DG and GR140IG fiber gateways allows remote attackers with valid credentials to execute arbitrary commands as root through the traceroute diagnostic handler. The vulnerability exists in the /bin/httpd_clientside component where unsanitized destAddr parameters are passed directly to system() calls, enabling shell command substitution attacks. With CVSS 8.8 (High) but EPSS exploitation probability of only 0.04% (12th percentile), this vulnerability affects widely-deployed ISP-managed CPE devices in France (SFR network) but shows no evidence of active exploitation or public POC availability at time of analysis.
Command injection in ALTICE LABS GR140DG and GR140IG fibre routers allows authenticated remote attackers to execute arbitrary commands as root. The ping diagnostic handler in /bin/httpd_clientside accepts unsanitized user input in the destAddr parameter and passes it to a system() call, enabling shell command substitution. SSVC indicates total technical impact with no confirmed exploitation; EPSS score of 0.04% (12th percentile) suggests low observed exploitation activity, though the availability of a detailed security advisory (XEROD-2026-0001) may increase attack surface awareness among threat actors.
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-STD.PROD-1 allows attackers to execute arbitrary system commands via the /action/SetRemoteAccessCfg endpoint in the GoAhead web server. CVSS 9.1 reflects critical impact with network-accessible attack vector requiring no authentication or user interaction. GitHub repository suggests publicly available exploit code exists (CVE-2026-36356), significantly lowering exploitation barrier for attackers targeting industrial IoT and cellular gateway deployments.
Remote code execution as root in nginx-ui versions before 2.3.8 via unauthenticated backup restore within 10-minute startup window. Attackers exploit the completely unauthenticated /api/restore endpoint during initial installation to upload malicious backup archives that overwrite app.ini configuration with injected OS commands in TestConfigCmd setting. After automatic application restart, command injection triggers with privileges of the nginx-ui process - typically root in Docker deployments. EPSS data not available; no active exploitation reported but publicly disclosed via GitHub Security Advisory GHSA-4pvg-prr3-9cxr. Patch released in version 2.3.8.
Remote unauthenticated command injection in WDR201A WiFi Extender (HW V2.1, FW ≤1.02) allows attackers to execute arbitrary OS commands with device privileges via five vulnerable firewall.cgi handlers without authentication. Injected commands persist in NVRAM and automatically re-execute on every subsequent firewall request, creating a self-sustaining backdoor. Public exploit code exists per VulnCheck, making this an immediate weaponization risk for exposed devices. CVSS 9.3 reflects network attack vector with no complexity or authentication barriers (AV:N/AC:L/PR:N), though real-world impact depends on whether management interfaces are internet-exposed.
Remote code execution in WDR201A WiFi Extender (HW V2.1, FW ≤1.02) allows unauthenticated attackers to execute arbitrary OS commands via the adm.cgi binary's reboot_time parameter. The vulnerability stems from unsanitized input handling in the reboot scheduling function, exploitable by sending crafted POST requests with shell metacharacters when reboot_enabled=1. Public exploit code exists (CVSS 9.3, SSVC: automatable/total impact), making this a critical priority for affected deployments despite no confirmed CISA KEV listing at time of analysis.
Remote code execution in WDR201A WiFi Extender (HW V2.1, FW ≤1.02) allows unauthenticated network attackers to execute arbitrary OS commands via the makeRequest.cgi binary. Exploitation requires no user interaction and has CVSS:4.0 score of 9.3. Publicly available exploit code exists (confirmed by VulnCheck and CISA SSVC framework), enabling automated attacks against exposed devices. SSVC designates this as automatable with total technical impact, representing immediate operational risk to internet-facing extenders.
OS command injection in WDR201A WiFi Extender firmware v1.02 allows unauthenticated remote attackers to execute arbitrary shell commands via the gateway parameter in internet.cgi. Exploitation requires no user interaction or authentication against internet-exposed devices. Public exploit code exists (VulnCheck advisory), demonstrating active security research interest. CVSS 9.3 reflects maximum network exploitability (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity, and availability impact on the device itself. No vendor patch identified at time of analysis for this discontinued consumer IoT product.
Remote code execution in WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) allows unauthenticated network attackers to execute arbitrary shell commands via OS command injection in the wireless.cgi binary. Attackers exploit unsanitized sz11gChannel or PIN POST parameters in set_wifi_basic and set_wifi_do_wps functions to achieve root-level code execution without authentication. Publicly available exploit code exists. CVSS v4.0 score of 9.3 reflects the critical nature: network-accessible, no complexity, no authentication required, with high confidentiality, integrity, and availability impact. SSVC assessment confirms POC availability, full automatable exploitation, and total technical impact-making this a high-priority remediation target despite no confirmed active exploitation (not CISA KEV-listed).
Remote code execution in Evolver versions before 1.69.3 allows unauthenticated network attackers to execute arbitrary shell commands via command injection in the _extractLLM() function. Attackers exploit unsanitized corpus parameters passed to execSync() through string concatenation in a curl command, achieving full system compromise. GitHub security advisory GHSA-j5w5-568x-rq53 confirms the vulnerability with proof-of-concept demonstrating shell command substitution bypass. CVSS score of 9.8 reflects no authentication or user interaction requirements. No CISA KEV listing or EPSS data provided, suggesting exploitation status remains uncertain beyond confirmed POC availability.
Remote code execution in SambaBox 5.1-5.2 allows authenticated administrators to inject and execute arbitrary OS commands through improper input sanitization. Attackers with high-privilege access can achieve full system compromise with confidentiality, integrity, and availability impact. Reported by Turkish national CERT (TR-CERT/USOM), no CISA KEV listing or public exploit code identified at time of analysis, indicating limited observed exploitation activity.
Authenticated OS command injection in the DdnsSetting.cgi handler of GeoVision GV-LPC2011/LPC2211 license plate capture cameras (firmware 1.10) lets an attacker with low-privilege access to the device web interface execute arbitrary OS commands by writing a crafted value into the DDNS configuration. CVSS scores the issue 8.8 (high) with full confidentiality, integrity, and availability impact, and Talos has published an advisory (TALOS-2025-2326); no public exploit identified at time of analysis and EPSS is low at 0.17%.
Command injection in Caesium Image Compressor (all versions through commit 02da2c6) allows local authenticated attackers to execute arbitrary OS commands via unsanitized input to shutdownMachine and putMachineToSleep functions in PostCompressionActions.cpp. The vulnerable code uses system() calls without input validation, enabling shell metacharacter injection during post-compression power management operations. Patch available via GitHub PR #376 replacing system() with QProcess::startDetached(). EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability. No evidence of active exploitation or public POC beyond the researcher's advisory.
Malicious code injection in Bitwarden CLI 2026.4.0 distributed via npm for 90 minutes on April 22, 2026, enables remote command execution without authentication. The compromise was part of a broader Checkmarx supply chain attack targeting the npm registry. Users who installed this specific version during the 21:57Z-23:30Z window received a backdoored package capable of executing arbitrary OS commands. EPSS data not available for this recent CVE, but the supply chain vector and brief exposure window suggest targeted rather than mass exploitation.
Command injection in Totolink NR1800X router firmware 9.1.0u.6279_B20210910 allows authenticated remote attackers to execute arbitrary system commands via the setUssd parameter in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (POC confirmed via GitHub). EPSS data not provided, but CVSS v4.0 base score of 7.4 with low attack complexity (AC:L) and network attack vector (AV:N) indicates moderate-to-high severity for internet-facing devices with default credentials or weak authentication.
OS command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'proto' parameter in /cgi-bin/cstecgi.cgi CGI handler. A public proof-of-concept exploit exists on GitHub, significantly lowering the barrier for exploitation. CVSS 8.9 with network vector, low complexity, and no authentication requirements makes this immediately exploitable against internet-facing devices running the vulnerable firmware version.
Remote code execution in HKUDS OpenHarness allows authenticated remote attackers to execute arbitrary operating system commands via the /bridge slash command. Attackers with remote sender privileges can invoke '/bridge spawn' with malicious command arguments that bypass input validation and execute directly through the shell subprocess helper, granting access to local files, credentials, workspace state, and repository contents. Vendor-released patch available (commit 438e373) that restricts /bridge to local-only invocation by default.
Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to execute arbitrary shell commands with SYSTEM privileges on the underlying host. The vulnerability exists in the FSx Windows File Server volume mounting component (versions prior to 1.103.0), where username field input is not properly sanitized before being passed to OS commands. This affects AWS customers running Windows-based ECS container workloads with FSx volumes - exploitation requires IAM permissions to register ECS task definitions or write to credential stores (Secrets Manager/SSM Parameter Store) used by FSx configurations. Vendor-released patch: version 1.103.0. EPSS and KEV data not provided; no public exploit identified at time of analysis.
Command injection in Pallets Click's click.edit() function (versions ≤8.3.2) allows local attackers with high privileges to execute arbitrary OS commands via shell metacharacters. The vulnerability stems from unsafe use of shell=True in subprocess calls, fixed in version 8.3.3 by switching to shlex.split for command parsing. Attack complexity is high (AC:H) and requires user interaction (UI:R), limiting real-world exploitation despite CVSS 7.2 score. Public proof-of-concept exists (SSVC: exploitation=poc) but no evidence of active exploitation (not in CISA KEV). EPSS data not provided but expected low given local-only access vector and multiple exploitation constraints.
Remote code execution in DocsGPT 0.15.0 through 0.16.0 (exclusive) lets an attacker reach the application's 'MCP test' function and submit a crafted payload that bypasses its validation to run arbitrary commands on the host. Because the hosted arc53 DocsGPT site and any local or public self-hosted deployment expose the same code path, exploitation requires no authentication or user interaction (CVSS 4.0 base 10.0, CWE-77 command injection). Publicly available exploit code exists per SSVC, though EPSS remains low at 0.29% and it is not listed in CISA KEV.
OS command injection in Pardus OS "My Computer" (versions up to and including 0.7.5, fixed in 0.8.0) lets an attacker execute arbitrary operating-system commands when a victim interacts with attacker-controlled input, inheriting the privileges of the file-manager process. Reported by Turkey's national CERT (TR-CERT) with a vendor patch available; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.10%).
Remote unauthenticated command injection in TOTOLINK N200RE V5 router allows complete device compromise via formMapDelDevice function. Attackers can execute arbitrary OS commands by injecting malicious payloads into the macstr or bandstr parameters with no authentication required (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Public proof-of-concept code exists per SSVC framework (exploitation: poc), making this immediately weaponizable against internet-facing devices. EPSS data unavailable, but CVSS vector and POC availability indicate critical real-world risk for consumer routers with default configurations exposed to the internet.
Remote unauthenticated command injection in Totolink A8000RU 7.1cu.643_b20200521 allows complete device compromise via crafted requests to the WiFi Guest Configuration CGI handler. Attackers can inject arbitrary OS commands through the 'merge' parameter in setWiFiEasyGuestCfg function at /cgi-bin/cstecgi.cgi, achieving full system control without authentication. Public exploit code exists (confirmed by CVSS E:P and GitHub POC reference), significantly lowering the barrier to exploitation. EPSS data not available, but the combination of network attack vector, no authentication requirement, low complexity, and publicly available exploit indicates elevated real-world risk for internet-facing devices.
Remote unauthenticated command injection in Totolink A8000RU 7.1cu.643_b20200521 allows attackers to execute arbitrary OS commands via the maxRtrAdvInterval parameter in the setRadvdCfg function of /cgi-bin/cstecgi.cgi. Public exploit code exists per VulDB submission, enabling immediate weaponization against exposed devices. CVSS 8.9 reflects network accessibility, no authentication requirement, and high impact across confidentiality, integrity, and availability - attack complexity is low with no user interaction needed, making this a critical priority for internet-facing Totolink routers.
OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows unauthenticated remote attackers to execute arbitrary system commands via the setOpenVpnClientCfg function in /cgi-bin/cstecgi.cgi by manipulating the 'enabled' parameter. Public exploit code exists (disclosed on GitHub), significantly lowering the barrier to exploitation. CVSS 8.9 reflects the complete compromise potential (confidentiality, integrity, availability) without requiring authentication or user interaction, making this a critical exposure for deployed devices.
Remote command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 allows unauthenticated attackers to execute arbitrary OS commands via the wifiOff parameter in setWiFiBasicCfg function. The vulnerability has a publicly available exploit (PoC on GitHub) and achieves full system compromise with network-accessible attack vector requiring no authentication or user interaction. EPSS data not available, but CVSS 8.9 (Critical) with exploitability confirmed (E:P) indicates immediate patching priority for exposed devices.
OS command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the User parameter in the setVpnAccountCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (GitHub POC), enabling immediate weaponization. CVSS 8.9 with full impact on confidentiality, integrity, and availability. EPSS data unavailable; not currently in CISA KEV, but the combination of network accessibility, no authentication requirement, and public exploit makes this a critical risk for internet-facing devices.
Command injection in Zyxel DX3301-T0 and EX3301-T0 routers allows authenticated administrators to execute arbitrary OS commands by injecting malicious input into the DomainName parameter of DHCP configuration. Affects firmware versions through 5.50(ABVY.7.1)C0. Vendor Zyxel has published a security advisory with remediation guidance. EPSS data not available; no public exploit identified at time of analysis. While CVSS score is 7.2 (High), practical risk is constrained by requirement for admin-level authentication, limiting exposure to credential compromise or malicious insider scenarios.
Remote command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows unauthenticated attackers to execute arbitrary OS commands via the 'enable' parameter in setPptpServerCfg function of /cgi-bin/cstecgi.cgi. Public exploit code exists (GitHub POC available), enabling trivial remote compromise without authentication or user interaction. CVSS v4.0 score of 8.9 reflects maximum impact on confidentiality, integrity, and availability. No EPSS data or CISA KEV status available, but publicly documented POC substantially lowers exploitation barrier for this home/small office router platform.
Remote command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows unauthenticated attackers to execute arbitrary OS commands with router privileges via the setUrlFilterRules CGI function. Public exploit code exists (CVSS:4.0 E:P indicator), significantly increasing exploitation risk. EPSS data unavailable, but network-accessible command injection with public POC represents critical risk for internet-exposed devices.
OS command injection in Totolink A8000RU router firmware version 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands with root privileges via the wscDisabled parameter in the setWiFiWpsStart function of /cgi-bin/cstecgi.cgi. Public exploit code exists (VulDB #359802), enabling trivial weaponization. EPSS score unavailable; CVSS 8.9 reflects network-based unauthenticated attack with complete device compromise. No CISA KEV listing at time of analysis, suggesting targeted rather than mass exploitation.
Command injection in Milesight camera web servers allows authenticated administrators with user interaction to execute arbitrary operating system commands. CISA ICS-CERT issued an advisory (ICSA-26-113-03), indicating operational technology/critical infrastructure relevance. Successful exploitation achieves complete compromise of camera confidentiality and integrity. Attack requires privileged credentials (admin-level) and user interaction, significantly limiting real-world exploitation scenarios compared to unauthenticated remote attacks.
Command injection in the Tenda HG3 2.0 gateway/router allows an authenticated remote attacker to inject arbitrary OS commands through the formTracert handler at /boaform/formTracert by manipulating the datasize argument (CWE-77). Publicly available exploit code exists (disclosed via VulDB), though there is no public exploit identified as being actively used in the wild and it is not listed in CISA KEV. EPSS is modest at 0.29% (52nd percentile), indicating exploitation is plausible but not yet widespread.
OS command injection in TOTOLINK A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating-system commands via the CsteSystem function in /cgi-bin/cstecgi.cgi. Attacker-controlled input passed through the CGI Handler's HTTP argument is concatenated into a system command without sanitization. Publicly available exploit code exists (SSVC exploitation status: poc); there is no public exploit identified as being used in active attacks, and EPSS is modest at 0.89% (76th percentile).
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote attackers execute arbitrary shell commands by injecting into the admpass argument of the setLoginPasswordCfg function in /cgi-bin/cstecgi.cgi. The CGI Handler passes attacker-controlled input to a system shell without sanitization, granting full device compromise. Publicly available exploit code exists (disclosed via VulDB/GitHub); no active exploitation is confirmed in CISA KEV, and EPSS is modest at 0.89% (76th percentile).
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary system commands by manipulating the tty_server argument passed to the setAdvancedInfoShow function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists and the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation yielding full confidentiality, integrity, and availability impact. EPSS is currently low (0.89%, 76th percentile) and there is no public exploit identified as being actively used in the wild per CISA KEV.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the sys_info argument passed to the setMiniuiHomeInfoShow function of /cgi-bin/cstecgi.cgi. Per the CVSS vector the attack is network-based with no privileges or user interaction required (PR:N/UI:N), and publicly available exploit code exists (published via VulDB/GitHub), though it is not listed in CISA KEV. EPSS is low at 0.89% (76th percentile), suggesting exploitation is plausible but not yet widespread.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to inject arbitrary operating-system commands through the telnet_enabled argument of the setTelnetCfg function in /cgi-bin/cstecgi.cgi. The flaw carries a CVSS 4.0 score of 8.9 with high impact to confidentiality, integrity, and availability, and publicly available exploit code exists, though it is not listed in CISA KEV. EPSS is modest at 0.89% (76th percentile), indicating publicly available exploit code exists but no confirmation of widespread active exploitation.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the HTTP argument processed by the CsteSystem function in /cgi-bin/cstecgi.cgi. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists and a POC has been disclosed; there is no public exploit identified as actively exploited in the wild (not on CISA KEV), and EPSS is low at 0.89%.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote, unauthenticated attackers execute arbitrary shell commands by manipulating the 'mode' parameter passed to the setWiFiAclRules function in the /cgi-bin/cstecgi.cgi CGI handler. Publicly available exploit code exists (VulDB) and SSVC rates it automatable with total technical impact, though EPSS remains modest at 0.89% (76th percentile) and it is not listed in CISA KEV. With CVSS 4.0 of 8.9 and no authentication required, any attacker reaching the device's web interface can gain full control.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote unauthenticated attackers execute arbitrary system commands by manipulating the 'tz' parameter of the setNtpCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (published via VulDB), and the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, total impact) reflects unauthenticated network reachability with full compromise, though EPSS remains modest at 0.89%. This is no public exploit identified as actively exploited - there is no CISA KEV listing at time of analysis.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the sambaEnabled argument passed to the setStorageCfg function in /cgi-bin/cstecgi.cgi. The CVSS 4.0 vector indicates network-reachable, unauthenticated exploitation (AV:N/PR:N/UI:N) with total impact on confidentiality, integrity, and availability. Publicly available exploit code exists (VulDB), though EPSS remains modest at 0.89% (76th percentile) and it is not listed in CISA KEV.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote attackers inject arbitrary operating-system commands through the wanIdx argument of the setDmzCfg handler in /cgi-bin/cstecgi.cgi. The CGI Handler passes attacker-controlled input into a shell context without sanitization, yielding full command execution on the device. Publicly available exploit code exists and the SSVC framework rates technical impact as total and the attack as automatable, though it is not listed in CISA KEV and EPSS remains modest at 0.89%.
OS command injection in Totolink A8000RU 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'merge' parameter in the setWiFiEasyCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists on GitHub (Litengzheng/vuldb_new2), enabling trivial exploitation against internet-facing devices. CVSS 8.9 reflects network attack vector with no authentication required (AV:N/PR:N), and EPSS data suggests moderate real-world exploitation probability given the POC availability and low attack complexity.
OS command injection in Totolink A8000RU 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via crafted addrPrefixLen parameter to the setIpv6LanCfg function in /cgi-bin/cstecgi.cgi. CVSS 8.9 (High) with CVSS:4.0 vector indicating network-accessible, low-complexity attack requiring no privileges or user interaction. Publicly available exploit code exists (GitHub POC), enabling weaponization by threat actors. Not currently listed in CISA KEV, suggesting limited observed exploitation despite public disclosure and high severity scoring.
OS command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'enable' parameter in the setUPnPCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (POC confirmed), increasing immediate risk for exposed devices. EPSS data not available, but CVSS 8.9 with network vector (AV:N), no authentication (PR:N), and low complexity (AC:L) indicates trivial remote exploitation against default configurations.
OS command injection in Totolink A8000RU 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'wizard' parameter in the setWizardCfg function of /cgi-bin/cstecgi.cgi. Public exploit code exists (CVSS E:P), significantly lowering the barrier to exploitation. EPSS data not available, but the combination of network attack vector (AV:N), no authentication (PR:N), low complexity (AC:L), and published POC indicates elevated real-world risk for internet-exposed devices.
OS command injection in Tenda HG3 router version 2.0 allows authenticated remote attackers to execute arbitrary commands with device privileges via the 'countrystr' parameter in /boaform/formCountrystr endpoint. Public exploit code exists (CVSS 4.0 E:P modifier confirms POC availability), enabling authenticated attackers to fully compromise router confidentiality, integrity, and availability. EPSS data unavailable; not currently in CISA KEV catalog, suggesting exploitation may be targeted rather than widespread despite public POC.
OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the setIptvCfg parameter in /cgi-bin/cstecgi.cgi. CVSS 8.9 (Critical) with network attack vector and no authentication required. Public exploit code available on GitHub since disclosure, significantly lowering exploitation barrier for attackers targeting internet-facing consumer routers. No vendor patch identified for this end-of-life device at time of analysis.
Remote code execution in Apache Camel's camel-coap component (versions 4.14.0-4.14.5, 4.18.0 before 4.18.1, and 4.19.0) allows an unauthenticated attacker to inject arbitrary internal Camel headers via CoAP URI query parameters, achieving OS command execution when a route forwards to a header-sensitive producer such as camel-exec. The component maps incoming CoAP query parameters straight into Exchange message headers with no HeaderFilterStrategy, so a single UDP packet to port 5683 can override the executable and arguments of a downstream exec producer and return command output in the CoAP response. Rated CVSS 10.0 with publicly available exploit code, though EPSS remains modest (0.55%, 68th percentile) and CISA SSVC records no observed exploitation, indicating opportunity rather than confirmed mass exploitation.
OS command injection in Tenda HG3 router version 2.0 (build 300003070) allows authenticated remote attackers to execute arbitrary system commands with router privileges via the fmgpon_loid parameter in the formgponConf administrative function. Public exploit code is available and confirmed usable for attacks per VulDB reporting, significantly lowering the skill barrier for exploitation despite requiring valid administrative credentials.
Command injection in LogonTracer versions prior to 2.0.0 allows authenticated users to execute arbitrary OS commands on the server. LogonTracer, a JPCERT/CC-developed log analysis tool for investigating lateral movement in Windows Active Directory environments, contains an insufficiently sanitized input handler that permits shell command injection. Authentication is required (PR:L), but once logged in, attackers can achieve complete system compromise with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). No active exploitation confirmed at time of analysis, though the CVSS 4.0 score of 8.7 and low attack complexity (AC:L) indicate significant risk for organizations running vulnerable versions.
Remote unauthenticated command injection in Tenda AC18 router firmware V15.03.05.05_multi allows complete device compromise via the SetSambaCfg interface. Attackers can execute arbitrary system commands by manipulating the guestuser parameter in HTTP requests to /goform/SetSambaCfg. CVSS 9.8 critical severity with network attack vector and no authentication required. EPSS score of 0.06% (19th percentile) suggests low observed exploitation despite extreme technical severity. Publicly documented exploit proof-of-concept exists on GitHub.
Command injection in leonvanzyl's autocoder (development snapshot commit 79d02a) lets remote, unauthenticated attackers achieve arbitrary code execution by supplying a crafted 'command' parameter to the /devserver/start endpoint, which passes attacker input to a shell. The CVSS 9.8 score reflects network-reachable, no-authentication exploitation with total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, though CISA's SSVC framework rates it as automatable with total technical impact; EPSS is low at 0.27% (50th percentile).
Command injection in ssh-mcp versions up to 1.5.0 allows authenticated local users to execute arbitrary OS commands via the Description parameter to the shell.write function in src/index.ts. Publicly available exploit code exists (GitHub issue #44) demonstrating the vulnerability. Despite CVSS 7.1 severity, real-world risk is moderate due to local-only attack vector and low EPSS score (0.06%, 18th percentile), indicating minimal observed exploitation attempts. Vendor has not responded to early disclosure via issue report.
OS command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 enables remote unauthenticated attackers to execute arbitrary system commands via the pptpPassThru parameter in the setVpnPassCfg function. Public exploit code exists on GitHub, dramatically lowering the barrier to exploitation. CVSS v4.0 base score of 8.9 reflects network attack vector, low complexity, and no authentication requirements, with high impact to confidentiality, integrity, and availability of the vulnerable device.
OS command injection in Linksys MR9600 router firmware 2.0.6.206937 allows authenticated administrators to execute arbitrary system commands via crafted 'pin' parameter to the BTRequestGetSmartConnectStatus JNAP action handler. Publicly available exploit code exists (CVSS E:P), enabling remote compromise of router with full system-level access. Vendor notified but unresponsive, leaving users without confirmed patch. EPSS data not available; CVSS 7.3 severity reflects high impact limited by high privilege requirement (PR:H).
Remote code execution in electerm's npm install script allows unauthenticated attackers to execute arbitrary system commands on Linux systems during package installation. The install.js script unsafely concatenates attacker-controlled version strings from the project's update server directly into an 'rm -rf' command, enabling command injection. This critically affects users installing electerm via 'npm install -g electerm' on Linux, as a compromised update server or man-in-the-middle attacker could inject malicious commands during the installation process. The vulnerability has been patched in commit 59708b38c8, and the fixed version is already published to npm.
Authenticated local users can execute arbitrary code on Windows, macOS, and Linux via HTML injection in SiYuan desktop notification messages through version 3.6.4. The Electron-based desktop application mishandles notification rendering with unsafe settings (nodeIntegration enabled, contextIsolation disabled, webSecurity disabled), escalating XSS to full system compromise. Vendor-released patch available in version 3.6.5. No evidence of active exploitation (not in CISA KEV) or public exploit code at time of analysis.
Command injection in Roxy-WI versions prior to 8.2.6.4 enables authenticated attackers to execute arbitrary OS commands with sudo privileges on managed servers. The vulnerability stems from unsanitized input in the /config/<service>/find-in-config endpoint that breaks out of grep command context during remote SSH execution. A proof-of-concept exploit exists (CVSS E:P), and the CVSS 4.0 score of 7.4 reflects network-based attack with low complexity requiring only low-privilege authentication. Vendor-released patch 8.2.6.4 available via GitHub commit 02f147d.
Remote code execution in OpenLearnX (npm package openlearnx) before 2.0.3 lets an authenticated low-privilege user escape the Python code-execution sandbox and run arbitrary OS commands on the host. Because submitting code to the compiler/execution environment is the platform's intended feature, any user with access to that endpoint can weaponize it. Classified CWE-78 (OS command injection); no public exploit identified at time of analysis, EPSS 0.41% (61th percentile), and the flaw is fixed in 2.0.3.
OS command injection in radare2-mcp (the Model Context Protocol server that bridges the radare2 reverse-engineering framework to LLM agents) versions 1.6.0 and earlier lets remote, unauthenticated attackers achieve full remote code execution on the host. Attacker-controlled JSON-RPC parameters flow into r2_cmd_str() where shell metacharacters bypass the command filter, and because the fix re-enables radare2's exec/socket sandbox, the flaw effectively granted attackers direct shell access. Publicly available exploit code exists (reported by VulnCheck, POC referenced in issue #45); it is not listed in CISA KEV and EPSS is modest at 0.27% (51st percentile).
Remote code execution in FlowiseAI Flowise before 3.1.0 lets an unauthenticated attacker run arbitrary OS commands on the server via the Airtable Agent node. Because LLM-generated Python is executed without proper sandboxing, an attacker who can send prompts to a chatflow containing this node can use prompt injection to coerce the model into emitting malicious Python that runs in the context of the Flowise process. Reported through Trend Micro ZDI (ZDI-CAN-29412); publicly available exploit code exists (SSVC: PoC), though EPSS is low at 0.06% and it is not listed in CISA KEV.
Command injection in elFinder before 2.1.67 lets attackers reach OS command execution as the web server user through the resize command's bg (background color) parameter. When the file manager is configured with the ImageMagick CLI backend, the user-supplied bg value is interpolated into shell command strings without sufficient escaping, allowing shell metacharacter injection. Fixed in 2.1.67; no public exploit is identified at time of analysis, though the CVSS 4.0 threat metric E:P indicates proof-of-concept maturity, EPSS is low (0.44%), and it is not in CISA KEV.
Authenticated remote code execution in FlowiseAI Flowise (and the flowise-components package) prior to 3.1.0 arises from the CSVAgent node, which interpolates a user-supplied 'customReadCSV' Pandas string directly into Python code executed via pyodide. An authenticated attacker (or an unauthenticated one when FLOWISE_USERNAME/FLOWISE_PASSWORD are unset, via the 'x-request-from: internal' header bypass) can inject Python such as 'import os;os.system(...)' to run arbitrary commands on the server. Publicly available exploit code exists (PoC in the GHSA advisory); this is not listed in CISA KEV, and EPSS is modest at 0.62% (70th percentile).
Command injection in Paperclip @paperclipai/server (versions <2026.416.0) allows authenticated agents to execute arbitrary OS commands on the server host. Attackers with Agent API credentials can escalate from agent runtime to full server host control by injecting malicious shell commands through the adapterConfig.workspaceStrategy.provisionCommand field during workspace provisioning. CVSS 8.8 (high) with network-accessible attack vector and low complexity. Vendor patch available in version 2026.416.0. No public exploit or CISA KEV listing identified at time of analysis, but the vulnerability breaks critical trust boundaries in multi-agent AI orchestration systems.
Remote code execution in IBM Total Storage Service Console (TSSC) and TS4500 IMC versions 9.2 through 9.6 allows unauthenticated attackers to execute arbitrary commands with normal user privileges via improper input validation. The vulnerability carries a CVSS score of 7.3 with network attack vector and low complexity (AV:N/AC:L/PR:N/UI:N), enabling remote exploitation without authentication. No public exploit identified at time of analysis, and EPSS risk data is not available for this 2026 CVE.
Command injection in the TOTOLINK A3300R router (firmware v17.0.0cu.557_B20221024) lets remote attackers execute arbitrary OS commands by injecting into the stunEnable parameter of the /cgi-bin/cstecgi.cgi endpoint. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with total confidentiality, integrity, and availability impact, and publicly available exploit code exists via a GitHub PoC. Despite the 9.8 rating, EPSS is only 0.06% (19th percentile), and there is no CISA KEV listing, so no active exploitation is confirmed.
OS command injection in the TOTOLINK A3300R router firmware (v17.0.0cu.557_B20221024) lets remote attackers run arbitrary system commands by injecting shell metacharacters into the stunMaxAlive parameter handled by the /cgi-bin/cstecgi.cgi endpoint. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes unauthenticated network exploitation with total confidentiality, integrity, and availability impact, effectively granting full control of the device. Publicly available exploit code exists (GitHub PoC), though EPSS is very low (0.06%) and it is not listed in CISA KEV, so exploitation is proof-of-concept rather than confirmed in-the-wild.
OS command injection in TOTOLINK A3300R routers (firmware v17.0.0cu.557_B20221024) lets remote attackers run arbitrary commands by injecting shell metacharacters into the stunServerAddr parameter of the /cgi-bin/cstecgi.cgi endpoint. The flaw carries CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly available exploit code exists, though EPSS remains low at 0.06% and it is not listed in CISA KEV.
OS command injection in the TOTOLINK A3300R router (firmware v17.0.0cu.557_B20221024) lets remote attackers run arbitrary shell commands by injecting into the stunMinAlive parameter of the /cgi-bin/cstecgi.cgi endpoint. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 Critical with no authentication qualifier indicated, and CISA's SSVC framework marks it automatable with total technical impact. Publicly available exploit code exists (researcher writeup on GitHub), though EPSS remains very low at 0.06% and it is not on the CISA KEV list - no public exploit indicates active exploitation yet.
Command injection in radare2 PDB parser (versions before 6.1.4) enables arbitrary OS command execution when users analyze malicious PDB files. Publicly available exploit code exists. Attackers craft PDB files with newline characters in symbol names to inject radare2 commands during flag renaming operations, which then execute OS commands via radare2's shell operator when victims run the 'idp' command. CVSS 8.4 reflects local attack vector requiring user interaction, though EPSS data not available. Patch released in version 6.1.4 with detailed technical disclosure at blog.calif.io showing 0-day discovery process.
SQL injection in NocoBase's @nocobase/database package allows authenticated users with record-creation privileges to execute arbitrary SQL queries and extract database credentials. The vulnerability exists in the queryParentSQL() function, which constructs recursive Common Table Expression (CTE) queries using string concatenation instead of parameterized queries when processing tree collections with string primary keys. An attacker can inject malicious SQL by creating records with crafted primary key values, triggering the vulnerability when recursive eager loading occurs. Successful exploitation leads to full database compromise, with confirmed extraction of administrator credentials (emails and password hashes) in testing against PostgreSQL. On databases where the service account has elevated privileges, attackers can achieve operating system command execution via PostgreSQL's COPY...TO PROGRAM feature. Vendor patch available via GitHub PR #9133.
Remote code execution via unauthenticated command injection in rclone's remote control API allows network attackers to execute arbitrary commands on the host system through a single HTTP request. The vulnerability affects rclone deployments with the RC API enabled (--rc or rclone rcd) that are network-accessible and lack global HTTP authentication. An attacker exploits the unprotected operations/fsinfo endpoint by crafting a WebDAV backend definition with a malicious bearer_token_command parameter, which executes during backend initialization. Confirmed exploitable on master branch (commit bf55d5e6) and release v1.73.4 with public proof-of-concept available. CVSS 9.2 reflects critical severity with network attack vector and no authentication required, though exploitation requires specific deployment configuration (AT:P). No CISA KEV listing or EPSS data available at time of analysis.
OS command injection in GitHub Enterprise Server (all releases prior to 3.21) lets an authenticated Management Console administrator run arbitrary shell commands on the underlying appliance by embedding shell metacharacters in proxy configuration fields such as http_proxy. The flaw was reported through the GitHub Bug Bounty program and there is no public exploit identified at time of analysis; EPSS is negligible (0.01%, 3rd percentile) and CISA SSVC rates exploitation as none. Because it requires high-privilege console access, it is primarily a privilege-boundary escape from Management Console admin to full OS-level control rather than a remotely reachable pre-auth issue.
Remote code execution in AVideo versions 29.0 and below allows unauthenticated attackers to execute arbitrary shell commands on the server via command injection in the CloneSite plugin's cloneServer.json.php endpoint. Attackers exploit unsanitized user input in the 'url' parameter that gets directly concatenated into a wget command executed through PHP's exec() function. With CVSS 8.9 (AV:N/AC:L/PR:N/UI:N) and proof-of-concept exploitation confirmed (E:P), this represents a critical risk requiring immediate patching. Fix available in commit 473c609fc2defdea8b937b00e86ce88eba1f15bb.
Remote code execution in WWBN AVideo up to version 29.0 allows unauthenticated attackers to execute arbitrary system commands via unsanitized URL parameters in test.php. This vulnerability stems from an incomplete fix that sanitized wget calls but left file_get_contents and curl code paths exploitable through regex bypass (accepting strings like 'httpevil[.]com'). CVSS 9.3 with Critical scope change reflects the severity. Upstream fix available in commit 78bccae but no tagged release version confirmed at time of analysis. EPSS data not provided; no CISA KEV listing identified.
Command injection in Tenda W30E V2.0 firmware V16.01.0.21 allows remote unauthenticated attackers to execute arbitrary operating system commands as root through the formSetUSBPartitionUmount function by manipulating the usbPartitionName parameter. The vulnerability achieves maximum CVSS severity (9.8) due to network accessibility without authentication, though EPSS exploitation probability remains low (0.17%, 38th percentile), suggesting limited attacker interest at time of analysis. No active exploitation confirmed by CISA KEV, and public exploit code status is unverified from researcher disclosure.