Command Injection
Monthly
OS command injection in Johnson Controls Illustra Standard - L4L China (versions before 6.0.0.66394 on Windows) allows an authenticated low-privilege attacker, with user interaction and an additional attack precondition, to execute arbitrary commands on subsequent connected systems, though the camera itself suffers no direct loss of confidentiality, integrity, or availability. The vendor CVSS 4.0 base score is 5.1, and no public exploit code or active exploitation has been identified at time of analysis. This moderate-severity issue requires a valid account on the device and passive user interaction, limiting its overall risk.
Authenticated command injection in reNgine up to 2.2.0 allows a low-privileged user to execute arbitrary OS commands on the server by supplying a crafted target Name, which is passed to a shell command during the subdomain_discovery task. Publicly available exploit code exists (GitHub issue #1561), and the upstream fix PR #1562 awaits acceptance, so no released patched version is confirmed. Independent assessment rates the impact as high (CVSS 3.1: 8.8), while the vendor's CVSS 4.0 score of 2.1 reflects limited scope and low impact ratings, creating a sharp conflict in severity signals; no CISA KEV confirmation was provided.
Arbitrary shell command execution in the Chainguard Academy (edu) integrate-platform-docs composite GitHub Action requires control of the project_id or storage_bucket inputs and occurs because those values were substituted directly into Bash gcloud storage cp commands. The practical exposure is narrow: the only in-repository caller passed repository secrets and ran on trusted triggers, so untrusted input was not known to reach the vulnerable steps, and abuse requires write or maintainer control over the CI configuration rather than a remote unauthenticated path. A vendor fix is available via commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3, no public exploit was identified, and the independent assessment rates this as a low-priority issue (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N).
OS command injection in Johnson Controls EasyIO FS32 building-automation controllers running firmware before 3.0b63 allows an attacker who already holds high-privileged access on the device to execute arbitrary operating-system commands, with the 7.2 High score reflecting adjacent-network reachability, high attack complexity, and additional attack requirements as well as severe availability and downstream scope impact. Only firmware versions prior to 3.0b63 are affected, and exploitation is not a remote-internet scenario: the attacker must be positioned on the adjacent building-automation/OT network and must already be authenticated with elevated privileges, which effectively limits realistic abuse to insiders or adversaries who have established an OT foothold. There is no public exploit code identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing); the exact feature or parameter carrying the injected command is not specified in the available description.
Command injection in Red Hat Satellite's Hammer CLI (rubygem-hammer_cli) allows a local authenticated user to run arbitrary shell commands by controlling the $EDITOR environment variable, which the application interpolates into a single-string Ruby system() call that is then interpreted by /bin/sh. The flaw affects Red Hat Satellite 6 and Satellite 6.19 for RHEL 9, and exploitation requires an attacker to already hold a valid local account, be able to set $EDITOR, and trigger a CLI operation that launches an external editor (such as editing a resource), meaning remote or unauthenticated exploitation is not possible. Public exploit code and confirmed active exploitation are not indicated in the available intelligence, and Red Hat has published an erratum (RHSA-2026:74503) to address the issue.
Command injection in the optional repository-connector feature of Kiteworks Core allows an authenticated system administrator to append shell commands to a user-supplied path, resulting in code execution as the connector's service account and arbitrary file writes within that account's permissions. Only deployments running Kiteworks Core below 9.5.1 that have licensed and enabled the non-default repository connector are exposed, and successful exploitation additionally requires the appliance to be able to reach an attacker-controlled host over the network, as the injected command must pull or deliver content externally. Rated CVSS 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H); there is no public exploit code identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), so real-world risk is best characterised as LOW-to-MEDIUM despite the high-integrity/high-availability outcome, given the layered prerequisites of admin privilege, a separately licensed feature, and outbound egress.
OS command injection in the Git Remove MCP Tool of 0xshariq github-mcp-server (all revisions up to commit 52e764a7d66eac1726fce02ca7bb5a638571801a) lets an attacker who can influence the tool's 'File' argument inject shell metacharacters that are executed by child_process.exec in src/github.ts. Publicly available exploit code exists (reported via a GitHub issue on the project's own repository), but there is no evidence of confirmed active exploitation in CISA KEV, and the vendor has not responded to the report. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates confidentiality, integrity and availability impact as high, although the practical exposure depends heavily on how the MCP server is deployed - a network-accessible MCP transport makes the AV:N path realistic, whereas a local stdio deployment limits reach to whatever can feed input into the connected LLM client.
Unauthenticated OS command injection in HKUDS AnyTool 0.1.0 lets a remote attacker execute arbitrary shell commands on the host running the tool, because the Execute Endpoint in anytool/local_server/main.py passes attacker-controlled 'command'/'shell' arguments directly into subprocess.run. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) the endpoint requires no credentials or user interaction, so any deployment that exposes the local_server on a reachable interface - rather than loopback-only - is directly exploitable. Publicly available exploit code exists, and the project was notified via GitHub issue #6 but has not responded; no vendor patch has been identified at time of analysis. VulDB scored this 6.9 by rating impact conservatively as VC:L/VI:L/VA:L, while our independent assessment (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) treats shell-level compromise of the host as high impact - treat the practical risk as higher than the published 6.9 suggests.
OS command injection in the PFU Limited Image Scanner Driver for Linux (both the fi series and sp series packages) allows a user who already holds a valid login on the affected host to execute arbitrary operating-system commands, potentially at the privilege level of the driver or its helper processes. Exploitation is not remote and not trivial: the assessed vector (AV:L/AC:H/PR:L/UI:R) and the vendor's own wording that the attacker must make 'certain preparations' indicate that a local account plus staging of specific conditions, and possibly a triggering scan-related action by another user, are prerequisites. No public exploit identified at time of analysis and no CISA KEV listing was present in the supplied intelligence, so this is assessed as a genuinely moderate rather than high priority issue - the confidentiality, integrity and availability impact is high where it is successfully triggered, but the local-access and high-complexity gates sharply limit realistic exposure.
Command injection in MODSetter SurfSense through version 2.0.3 allows an authenticated low-privilege user to execute arbitrary shell commands on the host by sending a crafted payload to the /api/search-source/connectors/mcp/test endpoint within the MCP Connector Integration component. Exploitation is remote with low complexity and no user interaction, but requires valid credentials and a reachable/configured MCP connector feature. Publicly available exploit code exists (a proof-of-concept was published to a public gist and referenced by VulDB), and the vendor was contacted about the disclosure but did not respond; no official patched version is confirmed, and the signals on severity conflict (vendor CVSS 4.0 base 5.3 versus our assessed CVSS 3.1 vector of 8.8).
OS command injection in RaspAP's raspap-webgui (raspap-webgui through version 3.5.5) lets an attacker who already holds a low-privileged authenticated session manipulate the cfg_id parameter of ajax/openvpn/del_ovpncfg.php to inject extra arguments/commands through the incomplete escapeshellcmd() filter. The flaw is remote but requires a valid session (CVSS 4.0 AV:N/AC:L/PR:L/UI:N, assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), and because escapeshellcmd only neutralizes shell metacharacters rather than argument boundaries, the realistic outcome is constrained argument injection affecting integrity and availability rather than unrestricted remote code execution. Publicly available exploit code exists (a referenced GitHub gist), but there is no indication of confirmed active exploitation (CISA KEV); the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
OS command injection in RaspAP's raspap-webgui component (versions up to and including 3.5.5) lets an authenticated, high-privilege RaspAP administrator execute arbitrary operating-system commands on the host by manipulating the SSID value that WiFiManager::writeWpaSupplicant writes into the wpa_supplicant configuration. Exploit code has been published publicly and may be used, so the technical details are already circulating, although there is no confirmation of active exploitation (the CVE is not in CISA KEV). Impact is web-admin-to-host-OS escalation rather than external compromise, since valid administrative web GUI credentials are a hard prerequisite; the vendor was contacted early about the disclosure but did not respond, and no vendor-released patched version has been identified.
OS command injection in mbailey VoiceMode through version 8.10.1 lets an authenticated local attacker who can reach the update_config MCP tool or the 'voicemode config set' CLI persist an arbitrary shell payload that executes as the service user on the next Whisper or serve service start (or reboot). The injected value is written verbatim into ~/.voicemode/voicemode.env, which the start scripts load with bash 'source', so constructs such as $(...) or backticks run even inside double quotes because bash performs command substitution there. This is a real but low-urgency issue: the config tools are not part of the default MCP tool set, so the deployment must have explicitly opted into exposing them, the vector is local (AV:L) with low privileges (PR:L), and execution is deferred until a service restart; no public exploit was identified at time of analysis and CISA SSVC records no observed exploitation. Vendor-released patch: v8.10.2.
Authenticated command injection in the D-Link DAP-2610 wireless access point (firmware up to 2.06B08r099) allows a user with valid low-privilege credentials on the web management interface to execute arbitrary system commands by supplying crafted parameters to the /index.xgi endpoint, giving full control of the device (CVSS 3.1 base score 8.8, C:H/I:H/A:H). The issue is network-reachable with low attack complexity and no user interaction, but authentication is required per the CVSS vector (PR:L), and CISA's SSVC assessment marks it as not automatable, so mass exploitation is unlikely. Publicly available exploit code exists; CISA KEV does not list this CVE, so active exploitation has not been confirmed at time of analysis.
Command injection in MISP misp-modules' cisco_firesight_manager_ACL_rule_export can cause arbitrary shell commands to be embedded in generated .sh export scripts when an authenticated MISP user with event/attribute submission privileges supplies values containing a single quote, such as a crafted ip-dst or url; an analyst who executes the script unmodified runs those commands with their own privileges. The issue requires active user interaction, does not directly compromise the MISP server, but can expose Cisco fireSIGHT Manager credentials, alter ACL rules, or compromise the analyst workstation, with a secondary NameError denial-of-service when the request lacks a config key. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the independent assessment views this as a genuine but conditional risk, and the upstream patch commit 625b54908efbd6acc8343aa3370d401dd370e748 adds shlex.quote and initializes config.
OS command injection in jhen0409's React Native Debugger up to 0.14.0 allows remote, unauthenticated attackers to run arbitrary shell commands on a developer workstation by supplying a crafted host value that reaches the openDevTools function in electron/window.js when the victim uses the 'Open in Editor' feature against an attacker-controlled debug target. Publicly available exploit code exists (the GitHub gist referenced by VulDB), but there is no confirmed active exploitation (CISA KEV) and the vendor was contacted and did not respond, so no vendor-released patch is identified. Scoring is moderate and consistent with a developer-targeted issue rather than a mass-exploitation priority: the vendor-supplied CVSS 4.0 score is 5.3 (UI:P, E:P) and our independent CVSS 3.1 assessment is 7.8 with high confidentiality, integrity and availability impact, reflecting that a successful injection executes with the privileges of the developer's account but requires the developer to connect the debugger to an attacker-influenced host and to trigger the editor/dev-tools launch.
Command injection in Termix's SSH key deployment flow affects versions 1.7.0 through 2.5.0 and lets an authenticated user with high privileges execute arbitrary commands with the selected remote account's privileges by supplying a crafted public-key token that breaks out of a double-quoted grep -F shell command. The independent assessment rates confidentiality, integrity, and availability impact as high with scope changed because code runs on the target host, not merely the Termix server; no public exploit has been identified at time of analysis, and the flaw is fixed in version 2.5.1.
OS command injection in Moonshot AI's Kimi Code (versions 0.31.0 and earlier) lets an attacker-controlled .mcp.json file in an untrusted workspace be auto-spawned by the MCP Configuration Loader before any trust confirmation, executing arbitrary OS commands on the developer's machine. Exploitation requires the victim to open or operate on the malicious workspace (user interaction) and to run a pre-0.31.1 version; publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV). Although the vendor rates this CVSS 4.0 at only 2.1, an independent assessment scores it 7.8 (CVSS 3.1, AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H) because CWE-78 command injection inside an AI agent's configuration loader normally yields full code execution.
Notepad++ releases prior to 8.9.8 enforce their shortcuts.xml HMAC integrity check on the Macro menu and keyboard-shortcut paths but omit it on the WM_MACRODLGRUNMACRO handler that powers the 'Run a Macro Multiple Times' dialog, so a tampered macro that is correctly blocked elsewhere still executes when invoked from that dialog. An attacker who can write to the current user's shortcuts.xml (for example later-stage malware, a tampered installer, or a low-integrity shared profile location) can plant a macro that calls internal Notepad++ commands, including commands that launch external programs, running entirely in that user's context with no privilege elevation. Exploitation is gated by local write access and by the victim opening the multi-run dialog; CVSS 3.1 rates it 6.7 (AV:L/AC:H/PR:L/UI:R), authentication requirements are authenticated for a local user per the provided vector (PR:L), and no public exploit identified at time of analysis. This is a genuine but low-urgency defense-bypass rather than a high-impact remote flaw.
Arbitrary shell command execution is possible in ProjectDiscovery Nuclei versions 3.0.0 through 3.9.x when DAST mode (-dast) loads an attacker-supplied, unsigned multiprotocol template that combines an HTTP fuzzing: block with a code: block, allowing the embedded unsigned code request to bypass the code-template signature check and run shell commands on the scanning host. The flaw is a signature-verification bypass (CWE-78 command injection) and is constrained in practice: it requires the operator to enable DAST and to point the scanner at a malicious template, and it does not affect users who scan only with trusted, signed first-party templates or who do not use DAST. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); it is fixed in Nuclei 3.10.0. Note that the independent assessment rates the vector at CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, treating confidentiality, integrity, and availability as fully impacted once the payload executes, which is a higher impact picture than the vendor-published 4.7 Medium score.
Command injection in the Feiyu Star Router (Chengdu Feiyuxing Technology, firmware build B-MB5E202-210322-r11656) lets an attacker who can reach the device's web management interface run arbitrary commands on the underlying operating system by manipulating the session_id cookie handled by /send_order.cgi?parameter=loginout. Publicly available exploit code exists, giving attackers a ready reference implementation, while the vendor did not respond to the disclosure, so no vendor-released patch has been identified at time of analysis. The vendor's CVSS 4.0 base score of 5.3 is internally inconsistent with the flaw class; an independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning a low-privilege authenticated attacker over the network can achieve high confidentiality, integrity and availability impact on the device, with the practical caveat that the management interface is normally LAN-facing and default or weak consumer credentials frequently make the PR:L prerequisite trivial to satisfy.
Command injection in the Feiyu Star Router web management CGI (/send_order.cgi?parameter=del_expmac) lets an attacker who already holds an authenticated router-administration session execute arbitrary shell commands on the device by embedding shell metacharacters in the 'mac' argument; the flaw is confined to firmware build B-MB5E202-210322-r11656 from Chengdu Feiyuxing Technology. The vendor was contacted early but never responded, so no official fix has been published, and publicly available exploit code exists for the affected endpoint. Because exploitation requires admin-level access (CVSS PR:H), risk is real but access-gated: the practical priority is moderate, driven mainly by the prevalence of default or weak credentials on SOHO router management interfaces rather than by any unauthenticated attack path.
Command injection in the nexus_reauth MCP tool of 0-Gaurav-0/nexus-mcp lets an attacker who can invoke that tool and control its 'url' argument run arbitrary operating-system commands through the unsanitized child_process.exec call in src/auth/browser.ts. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P), the project was notified via an issue report but has not responded, and because the project uses a rolling release model no fixed version is identified; the CNA scores the issue 2.1 under CVSS 4.0 while our independent assessment rates it 8.8 under CVSS 3.1, reflecting high confidentiality, integrity and availability impact on successful injection. Exploitation requires the nexus_reauth tool to be reachable and invokable and, per the PR:L vector, some low-level tool-invocation privilege rather than fully unauthenticated access, and the practical remote (AV:N) reach depends on whether the MCP server is actually network-exposed instead of local stdio only.
Authenticated command injection in SxDevOps 1.0/1.1 lets a signed-in user with host-task/command-generation rights defeat the platform's built-in dangerous-command filter and have arbitrary shell content reach managed hosts through the Command Handler (generate_host_task in backend/aiops/services.py). The pre-patch filter relied on substring matching of strings such as 'rm -rf', 'shutdown' and 'reboot', so shell metacharacters (; && || | backtick $() and newlines) could be smuggled into the 'command' argument to chain or substitute commands. Exploitation requires valid credentials plus at least one managed host configured to receive tasks, and no public exploit code has been identified at time of analysis; the vendor was contacted early and shipped a fix under commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9, making this a lower-priority safety-filter bypass rather than an unauthenticated takeover, consistent with the independent assessment scoring it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Command injection in SxDevOps 1.0 and 1.1 allows a high-privileged, authenticated operator to escape intended command restrictions when running TASK_RUN_COMMAND host tasks, because the user-supplied 'command' value is passed without neutralization to paramiko.SSHClient.exec_command in backend/ops/host_tasks.py (CWE-77). Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) the attacker must already hold a role permitted to create and execute host tasks, so the practical gain is bypassing command constraints via shell metacharacters (';', '&&', '||', '|', '$(', backticks, newlines) rather than obtaining access the operator lacks. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor shipped a fix (commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9) after being contacted early in the disclosure process.
Command injection in SxDevOps 1.0 and 1.1 lets an authenticated user who can manage MCP STDIO server configurations run arbitrary operating-system commands on the host by supplying shell metacharacters in the endpoint_or_command field, which is passed unchecked to subprocess.Popen. Exploitation requires high privileges (CVSS PR:H) because the attacker must be able to create or modify MCP STDIO server entries, and the feature must be reachable on an unpatched 1.0/1.1 build; there is no public exploit identified at time of analysis and no confirmed active exploitation. The issue is rated moderate by the independent assessment (CVSS:3.1 base 7.2) and is fixed upstream in commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9, which the vendor released after being contacted.
OS command injection in the Spatie Scotty developer CLI (through v1.4.4) lets a malicious 'host' value in a Scotty @servers configuration directive break out of the local shell and execute arbitrary commands when a victim runs the Doctor command. Because the host string is interpolated unescaped into Process::fromShellCommandline, shell metacharacters such as ';' and '${IFS}' in a crafted host are interpreted by the local shell rather than passed literally to ssh. This is a local CLI tool, so exploitation requires the attacker to get malicious configuration in front of the victim and the victim to subsequently invoke Doctor (checkSshConnectivity or checkRemoteTools), and any injected commands run only with the victim's own user privileges; no public exploit code has been identified at time of analysis, and vendor CVSS 4.0 rates this 5.3 with current exploit maturity unproven (E:X).
Authenticated command injection in IBM Cloud Pak for Data 5.1.2 lets a network-reachable, low-privileged user run arbitrary operating-system commands with elevated privileges on the underlying system. The flaw is an improper-neutralization-of-special-elements issue (CWE-78) in how user-supplied input is validated before being passed to a shell, and it rates CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning full loss of confidentiality, integrity and availability on the affected host once the attacker has any valid account. IBM has published a fix via its support advisory; no public exploit code has been identified at the time of analysis and there is no confirmation of active exploitation (CISA KEV).
Remote command injection in marcopiovanello yt-dlp-web-ui up to v4 lets a remote attacker (CVSS 4.0 vector records PR:N/UI:N, i.e. unauthenticated and no user interaction) abuse the params argument processed by NewGenericDownload in server/internal/downloaders/generic.go to inject arbitrary yt-dlp flags and shell metacharacters into the spawned download command. Publicly available exploit code exists - the flaw was publicly disclosed alongside the CVE, so any network-reachable instance of the generic download feature is a realistic target; there is no indication of confirmed active exploitation (not in CISA KEV). An upstream fix commit (c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897) replaces the previous weak sanitizer with a strict allowlist of yt-dlp flags, but no tagged patched release version is confirmed in the available data, so operators must either track the commit or restrict exposure.
Command injection in Microsoft Copilot allows an attacker to disclose confidential information when a victim invokes Copilot on attacker-controlled content containing improperly neutralized special elements. Exploitation requires the victim to trigger Copilot against the malicious content (UI:R) and depends on precise crafting to defeat the assistant's neutralization logic (AC:H), so it cannot be triggered unilaterally by the attacker, though no authentication is required of the attacker (PR:N). The flaw crosses a security boundary to expose highly confidential data with no integrity or availability impact (CVSS 3.1 base 6.1; S:C/C:H/I:N/A:N); there is confirmed actively exploited (CISA KEV) - no public exploit identified at time of analysis, and the underlying service has been remediated server-side, making residual real-world risk moderate and skewed toward opportunistic data theft rather than mass exploitation.
Authenticated OS command injection in Dromara mayfly-go through version 1.11.5 allows a low-privileged user who holds the machine:script:run permission and tag access to a target machine to execute arbitrary operating-system commands on that machine via the params argument of the RunMachineScript handler. No admin account is required, and publicly available exploit code exists (a public gist referenced in the CVE record), though there is no CISA KEV confirmation of active exploitation. The attack is remote, low complexity, and requires no user interaction, but it is gated by the two authorization grants and by the target machine's script template containing a {{.param}} placeholder where the unsanitized input is substituted before reaching the SSH execution layer.
Path-racing and shell-invocation weaknesses in the MidnightBSD mport package manager (all versions prior to 2.7.8) let a local, low-privileged attacker who can write to a participating package cache or staging path redirect privileged fetch, cache-clean, and install-related side effects outside the intended cache, and potentially influence command-line interpretation during privileged helper execution. The flaw spans libmport/fetch.c, clean.c, util.c, bundle_read_install_pkg.c, delete_primative.c, and libexec/mport.create/mport.create.c, and only becomes exploitable when a privileged mport operation runs concurrently so the attacker can win a timing-sensitive race; there is no remote reach and no public exploit identified at time of analysis. Because it requires local access, write permission on a shared cache/staging directory, and a hard-to-win race against a privileged process (AC:H, AT:P), the realistic risk is low-to-moderate despite the command-injection framing, and upgrading to 2.7.8 resolves it.
OS command injection in the IPsec Open API endpoint of Cisco Identity Services Engine (ISE) allows an authenticated, remote attacker holding valid administrative credentials to run arbitrary commands on the underlying operating system, and Cisco notes the obtained privilege level can be escalated easily to root. Exploitation is constrained to ISE nodes that have more than one network interface and that have one of those interfaces configured as an active IPsec tunnel, so default single-interface deployments without IPsec are not exposed; no public exploit code was identified at time of analysis. Although the CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N), Cisco has explicitly assigned a Security Impact Rating of High because of the short path from the achieved privilege level to root, making the raw numeric score a poor indicator of real-world severity.
Command injection in the web-based management interface of Cisco ThousandEyes Virtual Appliance allows an authenticated remote attacker with valid administrative credentials to save configuration details containing malicious values, leading to arbitrary OS command execution as root. Affected Cisco ThousandEyes Enterprise Agent versions per EUVD include 4.0, 4.1, 4.2, 4.4.2, 4.4.3, 4.4.4, 5.0, 5.1, 5.1.2, 5.1.3, and 5.2.0, and the primary limitation is the PR:H requirement for admin access. No public exploit identified at time of analysis, and the independent assessment characterizes this as a real but low-urgency issue.
Command injection (CWE-78) in HP's HPLIP (HP Linux Imaging and Printing) software enables an unauthenticated local user to execute commands or modify files with high integrity impact (VI:H) after active user interaction, matching HP's CVSS 4.0 score of 6.8 (AV:L/AC:L/PR:N/UI:A/VC:L/VI:H/VA:L) and the independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:R/C:L/I:H/A:L). The HP security bulletin HPSBPI04151 bundles this issue with other externally reported HPLIP flaws that could lead to remote code execution, privilege escalation, denial of service, or information disclosure, but the exact vulnerable component is not disclosed. No public exploit code or CISA KEV entry is identified at time of analysis, and the local vector plus mandatory user interaction prevents triggering without a user processing attacker-supplied input.
Authenticated command injection in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways (9.4.x, 9.5.x, 9.6.x and 9.7.0.0) lets a remote user who already holds limited access privileges submit specially crafted input that is passed to the underlying operating system, resulting in arbitrary command execution with elevated privileges or a denial-of-service condition on the appliance. The vendor-assigned CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) frames this as an availability-weighted, post-authentication issue rather than a pre-auth compromise. No CISA KEV listing, EPSS score or public proof-of-concept was supplied, so exploitation status is 'no public exploit identified at time of analysis'.
OS command injection in the exportOvpn handler of the TOTOLINK X5000R router firmware (9.1.0cu.2089_B20211224 and potentially other versions) allows an authenticated web-UI user to inject shell metacharacters through the 'filetype' argument supplied to /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user, resulting in commands executed with the privileges of the underlying CGI process. The flaw is remotely reachable (CVSS 4.0 AV:N/AC:L/AT:N/PR:L/UI:N) and publicly available exploit code exists, so any X5000R with an exposed or weakly-credentialed management interface should be treated as at risk. Impact per the supplied vector is limited (VC:L/VI:L/VA:L) but on an embedded device a successful injection typically yields full control of the appliance and its configuration.
Command injection in the D-Link DSL-3782 (firmware 2016-07-28) allows authenticated network attackers to execute arbitrary operating system commands by injecting shell metacharacters into the Addr argument of the Diagnostics web interface endpoint at /cgi-bin/New_GUI/Set/Diagnostics.asp. A public proof-of-concept exploit is available on GitHub, and the device is almost certainly end-of-life with no patch forthcoming from D-Link. The provided CVSS 4.0 score of 2.1 significantly understates the true impact, as command injection on embedded routers typically yields full root-level OS control of the device.
OS command injection in SabyasachiRana WebMap's nmap_newscan() function permits remote attackers to execute arbitrary shell commands by injecting metacharacters through the unsanitized target and params arguments in the New Nmap Scan Handler (functions_nmap.py). All repository commits up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25 are affected, and the flaw is exploitable without authentication per the CVSS PR:N vector. A public proof-of-concept exploit is available and a silent upstream patch has been committed without a formal security advisory.
Authenticated command injection in IBM i Access Family releases 1.1.2.0 through 1.1.9.15 allows a logged-in user to run arbitrary operating-system commands under their own normal user privileges by supplying a session file whose contents are parsed without proper input validation. Because the injected commands execute only with the rights of the invoking account, the confidentiality, integrity and availability impact is limited rather than system-wide. No public exploit code or CISA KEV activity is identified at time of analysis, and no EPSS score was supplied with the input data.
IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.15 fail to properly validate user-supplied input in the emulator macro 'RunProgram' action, allowing an authenticated user to execute arbitrary operating-system commands with normal user privileges through a crafted macro. The flaw is a classic OS command injection (CWE-78) reachable over the network at low complexity, but it grants no privilege escalation beyond the invoking user's own rights, which is why IBM rates it 6.3 rather than critical. There is no public exploit code and no CISA KEV listing at time of analysis, so this is a hardening and lateral-movement concern rather than an urgent emergency patch item.
Improper input validation in the STRPCCMD CL command handling of IBM i Access Client Solutions (IBM i Access Family 1.1.2.0 through 1.1.9.15) lets an authenticated IBM i user inject and execute arbitrary operating-system commands on the machine running the ACS client, using only that user's normal privileges. IBM rated the issue CVSS 6.3 (AV:N/AC:L/PR:L/UI:N, low confidentiality/integrity/availability impact) and classifies it as OS command injection (CWE-78). There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed as active.
OS command injection in MacCMS10 2026.1000.4055 allows an authenticated administrator to execute arbitrary system commands on the underlying server via the Template Handler component by submitting a crafted URL-encoded path parameter. A public proof-of-concept exploit exists, referenced through a GitHub issue report against the project repository. No vendor patch has been released; the project maintainer has not responded to the disclosure.
OS command injection in D-Link DWR-M921 firmware 1.1.52 exposes the router to remote arbitrary command execution via the WPS configuration endpoint. The `targetAPSsid` parameter passed to `/boafrm/formWsc` is not sanitized before being incorporated into a system-level command within the Boa embedded web server, allowing an authenticated administrator to execute arbitrary OS commands on the underlying embedded Linux system. A public proof-of-concept exploit authored by H3rmesk1t is available on GitHub, lowering the barrier for abuse significantly. No active KEV listing is present at time of analysis.
Command injection in D-Link DWR-M921 firmware 1.1.52 enables authenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the `devicename` parameter of the `/boafrm/formDiskPartition` web management endpoint. The firmware passes this parameter unsanitized to a C `system()` call, granting shell-level access to the device's underlying OS. A public proof-of-concept exploit has been disclosed on GitHub by researcher H3rmesk1t, confirming exploitability for any attacker in possession of valid administrative credentials.
OS command injection in D-Link DWR-M921 router firmware 1.1.52 permits authenticated remote attackers to execute arbitrary operating system commands by manipulating the sysCmd parameter submitted to the /boafrm/formsysCmd endpoint in the Boa embedded web server. Successful exploitation gives the attacker shell-level control over the device, enabling full compromise of routing, VPN, and wireless functions. A public proof-of-concept exploit has been disclosed on GitHub; no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.
Cross-site scripting in the Image Management component of Contec SolarView Compact (models sv-cpt-mc310 and sv-cpt-mc310f) enables authenticated attackers to inject malicious script that can trigger arbitrary OS command execution on the underlying device. Reported by JPCERT/CC (JVNVU97753461) with a Contec vendor advisory, the vulnerability chains CWE-79 XSS with a command injection pathway, making it more dangerous than its CVSS 4.0 score of 5.1 suggests. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored cross-site scripting in Contec SolarView Compact (sv-cpt-mc310 and sv-cpt-mc310f) solar power monitoring appliances affects the Schedule Settings and Mail Send Setting pages of the web management interface. An attacker who injects a malicious script into these configuration fields can cause arbitrary OS command execution when a privileged user renders the poisoned page in an authenticated session. No public exploit has been identified at time of analysis, and the vendor has issued a security advisory coordinated through JPCERT/CC under JVNVU97753461.
OS command injection in 0x4m4 HexStrike AI allows unauthenticated remote attackers to execute arbitrary shell commands by supplying metacharacter-laden values in the additional_args, target, username, password, scan_type, or payload fields of the /api/tools/* API endpoints, which pass these values directly into subprocess.Popen(shell=True) without sanitization. The PR diff confirms the flaw spans at least 97 API endpoints covering nmap, gobuster, nuclei, nikto, ffuf, and feroxbuster executors in hexstrike_server.py. A publicly available proof-of-concept exploit exists (GitHub issue #224) and a partial fix is in progress via PR #266, though PR #266 only addresses the additional_args parameter and may leave other injectable fields (target, username, password, scan_type, payload) unpatched.
OS command injection in HackingBuddyGPT up to version 0.5.0 allows a remote low-privileged attacker to execute arbitrary commands on the host running the tool by manipulating input processed by the `ssh_run_command` function in `src/hackingBuddyGPT/extensions/ssh_run_command.py`. The function fails to sanitize shell metacharacters before constructing and executing SSH commands, creating a classic CWE-78 unsanitized-input-to-shell scenario. A publicly available proof-of-concept exploit exists (GitHub issue #150), and the maintainer has not responded to the disclosure; no patch has been released as of this analysis.
OS command injection in HexStrike AI's Execute Endpoint allows remote unauthenticated attackers to execute arbitrary operating system commands on the server by manipulating the `code` or `script` parameters in `hexstrike_server.py`. The affected product is the rolling-release version of 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04. A public exploit has been disclosed via a GitHub issue report; the vendor has not yet responded, and no patch is available.
OS command injection via prompt injection in GH05TCREW PentestAgent's LocalRuntime allows a malicious target host to execute arbitrary shell commands on the operator's workstation. When the agent scans an adversary-controlled target, response content such as HTTP bodies, SSH banners, or DNS records flows unfiltered into the LLM's prompt context; a crafted payload steers the LLM into generating reverse-shell or persistence commands that LocalRuntime.execute_command() then runs with full operator-level privileges. A publicly available exploit exists (GitHub issue #91), and the upstream fix (PR #100) remains unmerged at time of analysis.
PentestAgent's MCP HTTP Server (up to commit cf882dabea3ed91cef016cdd115e5426315665a2) bound to all network interfaces (0.0.0.0) by default with zero authentication, allowing any remote attacker to call the `run_task` function in `interface/main.py` and execute arbitrary OS commands on the host running the agent. A public proof-of-concept is available via GitHub issue #90, and the fix (PR #101) adds bearer token auth and changes the default bind address to 127.0.0.1, but the pull request had not yet been merged at time of analysis. The CVSS 4.0 score of 6.9 substantially understates impact given that full unauthenticated OS command execution is achievable.
OS command injection in webgjc web_robot versions 2.4.0, 2.5.0, and 2.8.0 enables remote attackers to execute arbitrary operating system commands by supplying malicious input through the case_name parameter handled by the controller_listen or controller_recover functions in py/web.py. A publicly disclosed proof-of-concept exploit exists, the vendor failed to respond to responsible disclosure, and no patch has been released. The reported CVSS 4.0 base score of 5.3 reflects conservative impact ratings that appear inconsistent with the true scope of OS command injection on an unpatched host.
Command injection in LB-LINK AC1900_AZ2 router firmware V1.0.2 allows adjacent-network actors to inject OS commands through shell metacharacters passed to the bs_SetLimitCli_info function within libshare.so, triggered via a POST request to /goform/set_LimitClient_cfg. The vulnerability is notable for an internal contradiction: the CVSS vector assigns PR:H (administrative privileges required), yet the description explicitly frames the attack scenario as one where the actor lacks administrative access but can reach the endpoint - suggesting the endpoint may be accessible to lower-privilege or unauthenticated callers in certain deployments. No patch has been identified and no public exploit is confirmed at time of analysis beyond the researcher's GitHub write-up.
OS command injection in Palo Alto Networks Checkov by Prisma Cloud allows a local low-privileged user to execute arbitrary commands within the Checkov scanning process. Because Checkov is routinely deployed inside CI/CD pipelines holding cloud credentials and infrastructure deployment permissions, successful exploitation can propagate beyond the scanning host to affect subsequent systems at high confidentiality, integrity, and availability impact. No public exploit has been identified and Palo Alto Networks' own environmental scoring (1.1) reflects both the local-only attack vector and currently unreported exploitation activity.
Command injection in Palo Alto Networks PAN-OS allows an authenticated administrator to escape CLI restrictions and execute arbitrary OS commands as root via CWE-78 weaknesses in the Luna Hardware Security Module integration pathway. Exploitation is doubly gated: the attacker must hold administrative credentials with CLI access, and the target device must be configured with a Luna HSM - a niche cryptographic hardware module rarely deployed outside regulated or high-assurance environments. Panorama, Cloud NGFW, and Prisma Access are explicitly confirmed unaffected; vendor-released patches exist across all supported PAN-OS branches, and no public exploit or active exploitation has been identified.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to inject and execute scripts, resulting in high confidentiality impact. Affected are SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing.
Command injection in Dell PowerScale OneFS allows a local attacker with admin-level privileges to escalate to root, achieving full system compromise across confidentiality, integrity, and availability. Affected versions span three distinct release trains: 9.5.0.0-9.7.1.0, 9.8.0.0-9.10.1.0, and 9.11.0.0-9.14.0.1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the attack requires pre-existing local administrative access, substantially limiting the attack surface to insider threats or post-compromise scenarios.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 permits a local, low-privileged attacker to execute arbitrary OS commands on the affected host, potentially exposing sensitive configuration data and credentials stored on the appliance. Both physical Appliance deployments (prior to 5.36.00.16) and software Application deployments (prior to 5.36.00.00) are affected, as confirmed in Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified; Dell has released corrective patches for both form factors.
Command injection in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance and Application variants - permits unauthenticated remote attackers to perform script injection via network-accessible interfaces. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements in a Command), though Dell's own CVSS scoring constrains the impact to limited confidentiality exposure (C:L, I:N, A:N), suggesting the injected scripts are not fully executed as OS-level commands but rather reflected or partially evaluated. No public exploit code and no CISA KEV listing have been identified at time of analysis.
OS command injection in Okta Access Gateway (versions prior to 2026.9.1) allows an authenticated high-privileged local user to inject shell metacharacters into SNMP configuration values, causing a privileged backend script to execute arbitrary OS commands as root. The vulnerability (CWE-78) stems from failure to sanitize user-supplied configuration data before incorporating it into OS command construction. No public exploit or active exploitation has been identified; a vendor-released patch is available.
Command injection (CWE-77) in Visual Studio Code versions prior to 1.136.2 and GitHub Copilot enables a network-based attacker without authentication to trigger disclosure of sensitive information when a targeted developer interacts with specially crafted content. The attack requires high complexity (AC:H) and user interaction (UI:R), yielding a CVSS 5.3 Medium score that reflects real exploitation barriers. No public exploit code and no CISA KEV listing have been identified at time of analysis.
OS Command Injection (CWE-78) in Dell Secure Connect Gateway 5.0 permits low-privileged remote attackers to execute arbitrary operating system commands against both the Appliance and Application deployment variants. Affected versions are SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00; Dell has released fixes under advisory DSA-2026-382. No public exploit code or CISA KEV listing has been identified at time of analysis.
Command injection in the D-Link DIR-895L router's DHCP server daemon allows a network-adjacent attacker to execute arbitrary OS commands by crafting a malicious Hostname option in a DHCP request. The vulnerable code path is in the `sendACK` function of `udhcpcd/serverpacket.c`, where the client-supplied Hostname field is processed without sanitization, leading to shell injection. A public proof-of-concept exploit exists targeting firmware version A1_102b07, and no vendor patch has been identified at time of analysis.
Parameter injection in IBM i 7.3 through 7.6 allows a local authenticated attacker to inject malicious parameters into Control Language (CL) commands by exploiting improper neutralization of special elements (CWE-78). The flaw requires local access with low-level privileges and produces limited confidentiality and integrity impacts without availability consequence, consistent with the CVSS 4.4 Medium rating. IBM has released a patch via their support portal, and no public exploit code or active exploitation has been identified at time of analysis.
Command injection in the MongoDB extension for Visual Studio Code allows a remote attacker, via social engineering, to inject arbitrary shell characters into a terminal command composed by the extension when a developer opens its integrated shell feature against an attacker-controlled connection target. The extension fails to neutralize special characters from user-supplied MongoDB connection strings before embedding them in the command line, and the confirmation dialog shown to the developer does not render the injected payload, preventing visual detection. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the multi-step social-engineering requirement is the primary barrier to exploitation.
Command injection in Dell SmartFabric OS10 Software (versions prior to 10.5.6.14) allows a remote authenticated administrator to execute arbitrary OS commands on the underlying network operating system. Classified under CWE-77, the flaw requires high privilege and high attack complexity, yielding a vendor-assigned CVSS score of 5.0 - reflecting a substantially elevated bar for exploitation compared to typical network-reachable command injection. No public exploit code or active exploitation has been identified at time of analysis; Dell has released a patched version.
Command injection in Dell SmartFabric OS10 Software (versions prior to 10.5.6.14) allows a remotely-authenticated, high-privileged attacker to execute arbitrary OS commands via the network-accessible management interface. Dell disclosed and patched the issue through advisory DSA-2026-322, with version 10.5.6.14 as the confirmed fix. No public exploit code or active exploitation has been identified; the high-privilege and high-complexity prerequisites substantially constrain the realistic threat surface.
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administrator with adjacent network access to execute arbitrary operating system commands, leading to complete compromise of the affected system. The vulnerability spans at least eight WSO2 middleware products - including API Manager, Identity Server, Open Banking components, Traffic Manager, Universal Gateway, and API Control Plane - all of which share the Carbon Console administrative layer. The CVSS scope-change flag (S:C) indicates that successful exploitation extends impact beyond the WSO2 application boundary to the underlying host and potentially adjacent systems.
Authenticated OS command injection in CRMEB up to version 6.0.0 allows a backend administrator to execute arbitrary operating system commands by submitting malicious PHP code through the Custom Scheduled Task Feature's customCode parameter, which is passed directly to PHP's eval() function at /adminapi/system/crontab/save. The vendor characterizes this as intentional debug-only functionality, but the isSafePhpCode blacklist filter provides no meaningful containment against determined abuse. A public proof-of-concept exploit is available on GitHub, lowering the barrier to exploitation for any attacker who has obtained admin credentials.
OS command injection in Westermo WeOS 5.x (versions 5.24 and later) allows an authenticated administrator to execute arbitrary shell commands on the underlying device operating system by supplying a crafted media definition through the management interface. The scope change component of the CVSS vector confirms exploitation breaks out of the management application context into the OS layer, enabling full device compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CISA issued ICS advisory ICSA-25-261-01, elevating concern for operators in critical infrastructure sectors.
Command injection in ICP DAS UA-2200 and UA-5200 industrial IoT gateways (firmware up to 20260704) allows a network-authenticated attacker to execute arbitrary OS commands by manipulating the ParameterArray argument in the SetHostname CGI API endpoint. A publicly available proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving users without an official patch or mitigation guidance. Given that these are OT/ICS-class devices, successful exploitation may impact industrial operations, data integrity, and device availability beyond the immediate device itself.
OS command injection in Edimax BR-6214K firmware 1.40 allows an authenticated administrator to execute arbitrary commands on the router's underlying embedded OS by supplying shell metacharacters in the `pingstr` argument of the `asp_setPing` web endpoint. A public proof-of-concept exploit has been released on GitHub, and the vendor has not responded to disclosure nor issued a patch. Despite the low CVSS 4.0 score of 2.0 - driven entirely by the PR:H authentication requirement - successful exploitation yields root-level command execution on the device, making the practical impact significantly higher than the score suggests for any attacker who already possesses admin credentials.
OS command injection in Edimax BR-6214K firmware version 1.40 allows a remote authenticated administrator to execute arbitrary operating system commands by supplying a crafted value to the ateFunc parameter of the wlanMP.asp endpoint, which passes it unsanitized to a system() call. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for post-authentication exploitation. No vendor patch exists and the vendor did not respond to disclosure; no CISA KEV listing means active exploitation has not been confirmed by US government sources, though the unpatched status combined with public PoC availability elevates near-term risk.
OS command injection in the Diem CMS Administrative Console (diem-project/diem ≤ 5.1.3) allows authenticated administrators to execute arbitrary operating system commands on the host server via the unsanitized `dm_command` argument of the `executeCommand` function in `dmAdminPlugin/modules/dmConsole/actions/actions.class.php`. Publicly available exploit code exists via GitHub issue #447, and the project maintainers have not responded to the responsible disclosure report. The vulnerability is not in CISA KEV, but the unpatched status combined with available exploit code elevates urgency for any organization still running this abandoned software.
Git textconv injection in GitList 2.0.0 enables remote code execution on the server by exploiting repository-controlled `.gitattributes` textconv filter definitions. When a user browses a commit diff or blame view, GitList invokes `git show` or `git blame` without the `--no-textconv` guard, causing git to execute attacker-committed shell scripts as the web server process. A public proof-of-concept exists embedded in the patch's own regression test suite; the vulnerability is absent from the CISA KEV catalog at time of analysis.
SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the transport `name` configuration option to inject arbitrary SMTP commands by embedding CRLF sequences in the value. The EHLO, HELO, and LHLO commands are constructed via direct string concatenation in lib/smtp-connection/index.js without sanitization, enabling unauthorized email sending, spoofing, and phishing through the configured SMTP relay. A proof-of-concept is publicly available in the GHSA advisory; no KEV listing is present, indicating exploitation has not been confirmed at mass scale at time of analysis.
Command injection in the D-Link DIR-825M router (firmware 1.1.8) allows network-adjacent authenticated attackers to execute arbitrary OS-level commands by manipulating the `sysCmd` argument submitted to the `/boafrm/formSysCmd` endpoint, processed by function `sub_456CF4` without sanitization. A public proof-of-concept exploit exists and was published alongside the VulDB disclosure. The provided CVSS 4.0 score of 2.1 appears to severely understate the real impact - command injection in a router's System Command Execution interface typically yields full OS compromise, not low-severity system impact.
Command injection in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 allows network-accessible attackers with low-privilege credentials to execute arbitrary OS commands by manipulating the 'ussd' parameter in the setUssd function exposed via /cgi-bin/cstecgi.cgi. A proof-of-concept exploit has been publicly released on GitHub, lowering the skill threshold for exploitation. On embedded router firmware, CGI processes typically run with root or near-root privileges, meaning successful exploitation likely yields full device control - a substantially higher real-world impact than the provided CVSS 4.0 score of 2.1 suggests.
OS command injection in AlexGladkov claude-in-mobile 3.10.2 allows a local low-privileged attacker to execute arbitrary shell commands by supplying metacharacter-laced parameters to the tool's ADB and iOS simulator CLI subsystem. The Rust CLI modules (android.rs, ios.rs) interpolated caller-supplied strings - package names, permission identifiers, XML filenames, preference keys, SQLite database paths, and relative file paths - directly into device-side sh -c invocations without sanitization. A public proof-of-concept exists (GitHub issue #40), and a vendor-released patch (v3.10.3) is available.
Command injection in Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build) allows an adjacent-network attacker holding administrator credentials to execute arbitrary OS commands with root privileges. The flaw is in the update_interface_png SET handler within /usr/bin/webmgnt, where the display_name parameter is unsanitized and concatenated via sprintf() directly into a shell command string passed to system(). A public proof-of-concept is available on GitHub; EPSS at 0.17% (6th percentile) indicates no current widespread exploitation, and the vulnerability is not listed in CISA KEV.
Command injection in Wgcloud 3.6.4 exposes the server to remote code execution: the `content` parameter is unsanitized and directly concatenated into a Java `ProcessBuilder` call, allowing an adjacent-network attacker to inject arbitrary OS commands. The CWE-77 classification and the researcher's own proof-of-concept - titled RCE.md - confirm arbitrary code execution capability, making the submitted CVSS of 4.3 (C:L only) a significant understatement of real impact. No public exploit in CISA KEV, but publicly available exploit code exists per the researcher's GitHub disclosure.
OS command injection in Comfast CF-WR630AX firmware v.2.7.0.2 allows an adjacent-network attacker with administrator-level credentials to execute arbitrary OS commands through the device's web management interface and CGI endpoint via unsanitized parameters. A public proof-of-concept exploit is available on GitHub, though EPSS probability remains very low (0.19%, 9th percentile), indicating minimal observed exploitation activity. No active exploitation has been confirmed by CISA KEV, and the AV:A/PR:H CVSS vector materially constrains the realistic attacker population.
Remote command injection in TOTOLINK N600R firmware 4.3.0cu.7647_B20210106 allows unauthenticated network attackers to execute arbitrary OS commands by supplying shell metacharacters in the `ntp_server` parameter to the `getCurrentTime` handler at `/cgi-bin/cstecgi.cgi`. A public proof-of-concept demonstrating popen-based injection is available on GitHub, confirmed by the CVSS 4.0 E:P exploit maturity indicator, meaning exploitation requires minimal attacker skill. No vendor-released patch has been identified in available intelligence, leaving internet-exposed devices unmitigated.
OS command injection in zackees/transcribe-anything (versions up to 4.1.0) allows remote attackers to execute arbitrary system commands by supplying a crafted URL argument to the `ytdlp_download` function in `src/transcribe_anything/ytldp_download.py`. The CVSS 4.0 score is 2.9 - low - primarily because attack complexity is rated High, meaning exploitation requires specific conditions to align rather than trivial one-shot delivery. A publicly available proof-of-concept exploit exists via GitHub issue #137, and the vendor has not responded to the coordinated disclosure, leaving no patch available at time of analysis.
Argument injection in the Okta Privileged Access client allows a crafted SSH target username beginning with a hyphen to be interpreted as a command-line option by the underlying SSH subprocess. Organizations using Okta Privileged Access for SSH session brokering are affected when a user initiates a connection to a target whose username has been set to a hyphen-prefixed value. If exploited, an attacker who can influence the target username definition could cause the SSH client to process injected options, achieving high confidentiality impact. No public exploit code is identified at time of analysis, and CISA KEV does not list this CVE.
OS command injection in NVIDIA OpenShell for Linux's sandbox exec handler allows a low-privileged, network-accessible attacker to inject and execute arbitrary OS commands outside the intended sandbox boundary. All versions are affected per CPE data (cpe:2.3:a:nvidia:openshell:*:*:*:*:*:*:*:*), with confirmed potential impact spanning code execution, information disclosure, and data tampering. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Command injection in NVIDIA UFM Enterprise's IBDiagnet API allows an authenticated administrator with adjacency-level network access to execute arbitrary OS commands on the host system, potentially achieving full compromise. All major release trains are affected - GA, LTS 2023, LTS 2024, and LTS 2025 - as confirmed by NVIDIA's own advisory and NVD CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world opportunistic risk constrained by the high privilege and network adjacency prerequisites.
Command injection in NVIDIA UFM Enterprise's user management component enables an authenticated administrator to execute arbitrary OS-level commands by sending a crafted API request, spanning all active release tracks (GA, LTS 2023, LTS 2024, LTS 2025). Successful exploitation can yield full code execution on the UFM host, privilege escalation beyond the administrative role, and disclosure of sensitive InfiniBand fabric management data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the adjacent network attack vector (AV:A) constrains the realistic attacker population to those with both admin credentials and access to the management network segment.
OS command injection in Johnson Controls Illustra Standard - L4L China (versions before 6.0.0.66394 on Windows) allows an authenticated low-privilege attacker, with user interaction and an additional attack precondition, to execute arbitrary commands on subsequent connected systems, though the camera itself suffers no direct loss of confidentiality, integrity, or availability. The vendor CVSS 4.0 base score is 5.1, and no public exploit code or active exploitation has been identified at time of analysis. This moderate-severity issue requires a valid account on the device and passive user interaction, limiting its overall risk.
Authenticated command injection in reNgine up to 2.2.0 allows a low-privileged user to execute arbitrary OS commands on the server by supplying a crafted target Name, which is passed to a shell command during the subdomain_discovery task. Publicly available exploit code exists (GitHub issue #1561), and the upstream fix PR #1562 awaits acceptance, so no released patched version is confirmed. Independent assessment rates the impact as high (CVSS 3.1: 8.8), while the vendor's CVSS 4.0 score of 2.1 reflects limited scope and low impact ratings, creating a sharp conflict in severity signals; no CISA KEV confirmation was provided.
Arbitrary shell command execution in the Chainguard Academy (edu) integrate-platform-docs composite GitHub Action requires control of the project_id or storage_bucket inputs and occurs because those values were substituted directly into Bash gcloud storage cp commands. The practical exposure is narrow: the only in-repository caller passed repository secrets and ran on trusted triggers, so untrusted input was not known to reach the vulnerable steps, and abuse requires write or maintainer control over the CI configuration rather than a remote unauthenticated path. A vendor fix is available via commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3, no public exploit was identified, and the independent assessment rates this as a low-priority issue (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N).
OS command injection in Johnson Controls EasyIO FS32 building-automation controllers running firmware before 3.0b63 allows an attacker who already holds high-privileged access on the device to execute arbitrary operating-system commands, with the 7.2 High score reflecting adjacent-network reachability, high attack complexity, and additional attack requirements as well as severe availability and downstream scope impact. Only firmware versions prior to 3.0b63 are affected, and exploitation is not a remote-internet scenario: the attacker must be positioned on the adjacent building-automation/OT network and must already be authenticated with elevated privileges, which effectively limits realistic abuse to insiders or adversaries who have established an OT foothold. There is no public exploit code identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing); the exact feature or parameter carrying the injected command is not specified in the available description.
Command injection in Red Hat Satellite's Hammer CLI (rubygem-hammer_cli) allows a local authenticated user to run arbitrary shell commands by controlling the $EDITOR environment variable, which the application interpolates into a single-string Ruby system() call that is then interpreted by /bin/sh. The flaw affects Red Hat Satellite 6 and Satellite 6.19 for RHEL 9, and exploitation requires an attacker to already hold a valid local account, be able to set $EDITOR, and trigger a CLI operation that launches an external editor (such as editing a resource), meaning remote or unauthenticated exploitation is not possible. Public exploit code and confirmed active exploitation are not indicated in the available intelligence, and Red Hat has published an erratum (RHSA-2026:74503) to address the issue.
Command injection in the optional repository-connector feature of Kiteworks Core allows an authenticated system administrator to append shell commands to a user-supplied path, resulting in code execution as the connector's service account and arbitrary file writes within that account's permissions. Only deployments running Kiteworks Core below 9.5.1 that have licensed and enabled the non-default repository connector are exposed, and successful exploitation additionally requires the appliance to be able to reach an attacker-controlled host over the network, as the injected command must pull or deliver content externally. Rated CVSS 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H); there is no public exploit code identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), so real-world risk is best characterised as LOW-to-MEDIUM despite the high-integrity/high-availability outcome, given the layered prerequisites of admin privilege, a separately licensed feature, and outbound egress.
OS command injection in the Git Remove MCP Tool of 0xshariq github-mcp-server (all revisions up to commit 52e764a7d66eac1726fce02ca7bb5a638571801a) lets an attacker who can influence the tool's 'File' argument inject shell metacharacters that are executed by child_process.exec in src/github.ts. Publicly available exploit code exists (reported via a GitHub issue on the project's own repository), but there is no evidence of confirmed active exploitation in CISA KEV, and the vendor has not responded to the report. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates confidentiality, integrity and availability impact as high, although the practical exposure depends heavily on how the MCP server is deployed - a network-accessible MCP transport makes the AV:N path realistic, whereas a local stdio deployment limits reach to whatever can feed input into the connected LLM client.
Unauthenticated OS command injection in HKUDS AnyTool 0.1.0 lets a remote attacker execute arbitrary shell commands on the host running the tool, because the Execute Endpoint in anytool/local_server/main.py passes attacker-controlled 'command'/'shell' arguments directly into subprocess.run. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) the endpoint requires no credentials or user interaction, so any deployment that exposes the local_server on a reachable interface - rather than loopback-only - is directly exploitable. Publicly available exploit code exists, and the project was notified via GitHub issue #6 but has not responded; no vendor patch has been identified at time of analysis. VulDB scored this 6.9 by rating impact conservatively as VC:L/VI:L/VA:L, while our independent assessment (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) treats shell-level compromise of the host as high impact - treat the practical risk as higher than the published 6.9 suggests.
OS command injection in the PFU Limited Image Scanner Driver for Linux (both the fi series and sp series packages) allows a user who already holds a valid login on the affected host to execute arbitrary operating-system commands, potentially at the privilege level of the driver or its helper processes. Exploitation is not remote and not trivial: the assessed vector (AV:L/AC:H/PR:L/UI:R) and the vendor's own wording that the attacker must make 'certain preparations' indicate that a local account plus staging of specific conditions, and possibly a triggering scan-related action by another user, are prerequisites. No public exploit identified at time of analysis and no CISA KEV listing was present in the supplied intelligence, so this is assessed as a genuinely moderate rather than high priority issue - the confidentiality, integrity and availability impact is high where it is successfully triggered, but the local-access and high-complexity gates sharply limit realistic exposure.
Command injection in MODSetter SurfSense through version 2.0.3 allows an authenticated low-privilege user to execute arbitrary shell commands on the host by sending a crafted payload to the /api/search-source/connectors/mcp/test endpoint within the MCP Connector Integration component. Exploitation is remote with low complexity and no user interaction, but requires valid credentials and a reachable/configured MCP connector feature. Publicly available exploit code exists (a proof-of-concept was published to a public gist and referenced by VulDB), and the vendor was contacted about the disclosure but did not respond; no official patched version is confirmed, and the signals on severity conflict (vendor CVSS 4.0 base 5.3 versus our assessed CVSS 3.1 vector of 8.8).
OS command injection in RaspAP's raspap-webgui (raspap-webgui through version 3.5.5) lets an attacker who already holds a low-privileged authenticated session manipulate the cfg_id parameter of ajax/openvpn/del_ovpncfg.php to inject extra arguments/commands through the incomplete escapeshellcmd() filter. The flaw is remote but requires a valid session (CVSS 4.0 AV:N/AC:L/PR:L/UI:N, assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), and because escapeshellcmd only neutralizes shell metacharacters rather than argument boundaries, the realistic outcome is constrained argument injection affecting integrity and availability rather than unrestricted remote code execution. Publicly available exploit code exists (a referenced GitHub gist), but there is no indication of confirmed active exploitation (CISA KEV); the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
OS command injection in RaspAP's raspap-webgui component (versions up to and including 3.5.5) lets an authenticated, high-privilege RaspAP administrator execute arbitrary operating-system commands on the host by manipulating the SSID value that WiFiManager::writeWpaSupplicant writes into the wpa_supplicant configuration. Exploit code has been published publicly and may be used, so the technical details are already circulating, although there is no confirmation of active exploitation (the CVE is not in CISA KEV). Impact is web-admin-to-host-OS escalation rather than external compromise, since valid administrative web GUI credentials are a hard prerequisite; the vendor was contacted early about the disclosure but did not respond, and no vendor-released patched version has been identified.
OS command injection in mbailey VoiceMode through version 8.10.1 lets an authenticated local attacker who can reach the update_config MCP tool or the 'voicemode config set' CLI persist an arbitrary shell payload that executes as the service user on the next Whisper or serve service start (or reboot). The injected value is written verbatim into ~/.voicemode/voicemode.env, which the start scripts load with bash 'source', so constructs such as $(...) or backticks run even inside double quotes because bash performs command substitution there. This is a real but low-urgency issue: the config tools are not part of the default MCP tool set, so the deployment must have explicitly opted into exposing them, the vector is local (AV:L) with low privileges (PR:L), and execution is deferred until a service restart; no public exploit was identified at time of analysis and CISA SSVC records no observed exploitation. Vendor-released patch: v8.10.2.
Authenticated command injection in the D-Link DAP-2610 wireless access point (firmware up to 2.06B08r099) allows a user with valid low-privilege credentials on the web management interface to execute arbitrary system commands by supplying crafted parameters to the /index.xgi endpoint, giving full control of the device (CVSS 3.1 base score 8.8, C:H/I:H/A:H). The issue is network-reachable with low attack complexity and no user interaction, but authentication is required per the CVSS vector (PR:L), and CISA's SSVC assessment marks it as not automatable, so mass exploitation is unlikely. Publicly available exploit code exists; CISA KEV does not list this CVE, so active exploitation has not been confirmed at time of analysis.
Command injection in MISP misp-modules' cisco_firesight_manager_ACL_rule_export can cause arbitrary shell commands to be embedded in generated .sh export scripts when an authenticated MISP user with event/attribute submission privileges supplies values containing a single quote, such as a crafted ip-dst or url; an analyst who executes the script unmodified runs those commands with their own privileges. The issue requires active user interaction, does not directly compromise the MISP server, but can expose Cisco fireSIGHT Manager credentials, alter ACL rules, or compromise the analyst workstation, with a secondary NameError denial-of-service when the request lacks a config key. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the independent assessment views this as a genuine but conditional risk, and the upstream patch commit 625b54908efbd6acc8343aa3370d401dd370e748 adds shlex.quote and initializes config.
OS command injection in jhen0409's React Native Debugger up to 0.14.0 allows remote, unauthenticated attackers to run arbitrary shell commands on a developer workstation by supplying a crafted host value that reaches the openDevTools function in electron/window.js when the victim uses the 'Open in Editor' feature against an attacker-controlled debug target. Publicly available exploit code exists (the GitHub gist referenced by VulDB), but there is no confirmed active exploitation (CISA KEV) and the vendor was contacted and did not respond, so no vendor-released patch is identified. Scoring is moderate and consistent with a developer-targeted issue rather than a mass-exploitation priority: the vendor-supplied CVSS 4.0 score is 5.3 (UI:P, E:P) and our independent CVSS 3.1 assessment is 7.8 with high confidentiality, integrity and availability impact, reflecting that a successful injection executes with the privileges of the developer's account but requires the developer to connect the debugger to an attacker-influenced host and to trigger the editor/dev-tools launch.
Command injection in Termix's SSH key deployment flow affects versions 1.7.0 through 2.5.0 and lets an authenticated user with high privileges execute arbitrary commands with the selected remote account's privileges by supplying a crafted public-key token that breaks out of a double-quoted grep -F shell command. The independent assessment rates confidentiality, integrity, and availability impact as high with scope changed because code runs on the target host, not merely the Termix server; no public exploit has been identified at time of analysis, and the flaw is fixed in version 2.5.1.
OS command injection in Moonshot AI's Kimi Code (versions 0.31.0 and earlier) lets an attacker-controlled .mcp.json file in an untrusted workspace be auto-spawned by the MCP Configuration Loader before any trust confirmation, executing arbitrary OS commands on the developer's machine. Exploitation requires the victim to open or operate on the malicious workspace (user interaction) and to run a pre-0.31.1 version; publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV). Although the vendor rates this CVSS 4.0 at only 2.1, an independent assessment scores it 7.8 (CVSS 3.1, AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H) because CWE-78 command injection inside an AI agent's configuration loader normally yields full code execution.
Notepad++ releases prior to 8.9.8 enforce their shortcuts.xml HMAC integrity check on the Macro menu and keyboard-shortcut paths but omit it on the WM_MACRODLGRUNMACRO handler that powers the 'Run a Macro Multiple Times' dialog, so a tampered macro that is correctly blocked elsewhere still executes when invoked from that dialog. An attacker who can write to the current user's shortcuts.xml (for example later-stage malware, a tampered installer, or a low-integrity shared profile location) can plant a macro that calls internal Notepad++ commands, including commands that launch external programs, running entirely in that user's context with no privilege elevation. Exploitation is gated by local write access and by the victim opening the multi-run dialog; CVSS 3.1 rates it 6.7 (AV:L/AC:H/PR:L/UI:R), authentication requirements are authenticated for a local user per the provided vector (PR:L), and no public exploit identified at time of analysis. This is a genuine but low-urgency defense-bypass rather than a high-impact remote flaw.
Arbitrary shell command execution is possible in ProjectDiscovery Nuclei versions 3.0.0 through 3.9.x when DAST mode (-dast) loads an attacker-supplied, unsigned multiprotocol template that combines an HTTP fuzzing: block with a code: block, allowing the embedded unsigned code request to bypass the code-template signature check and run shell commands on the scanning host. The flaw is a signature-verification bypass (CWE-78 command injection) and is constrained in practice: it requires the operator to enable DAST and to point the scanner at a malicious template, and it does not affect users who scan only with trusted, signed first-party templates or who do not use DAST. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); it is fixed in Nuclei 3.10.0. Note that the independent assessment rates the vector at CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, treating confidentiality, integrity, and availability as fully impacted once the payload executes, which is a higher impact picture than the vendor-published 4.7 Medium score.
Command injection in the Feiyu Star Router (Chengdu Feiyuxing Technology, firmware build B-MB5E202-210322-r11656) lets an attacker who can reach the device's web management interface run arbitrary commands on the underlying operating system by manipulating the session_id cookie handled by /send_order.cgi?parameter=loginout. Publicly available exploit code exists, giving attackers a ready reference implementation, while the vendor did not respond to the disclosure, so no vendor-released patch has been identified at time of analysis. The vendor's CVSS 4.0 base score of 5.3 is internally inconsistent with the flaw class; an independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning a low-privilege authenticated attacker over the network can achieve high confidentiality, integrity and availability impact on the device, with the practical caveat that the management interface is normally LAN-facing and default or weak consumer credentials frequently make the PR:L prerequisite trivial to satisfy.
Command injection in the Feiyu Star Router web management CGI (/send_order.cgi?parameter=del_expmac) lets an attacker who already holds an authenticated router-administration session execute arbitrary shell commands on the device by embedding shell metacharacters in the 'mac' argument; the flaw is confined to firmware build B-MB5E202-210322-r11656 from Chengdu Feiyuxing Technology. The vendor was contacted early but never responded, so no official fix has been published, and publicly available exploit code exists for the affected endpoint. Because exploitation requires admin-level access (CVSS PR:H), risk is real but access-gated: the practical priority is moderate, driven mainly by the prevalence of default or weak credentials on SOHO router management interfaces rather than by any unauthenticated attack path.
Command injection in the nexus_reauth MCP tool of 0-Gaurav-0/nexus-mcp lets an attacker who can invoke that tool and control its 'url' argument run arbitrary operating-system commands through the unsanitized child_process.exec call in src/auth/browser.ts. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P), the project was notified via an issue report but has not responded, and because the project uses a rolling release model no fixed version is identified; the CNA scores the issue 2.1 under CVSS 4.0 while our independent assessment rates it 8.8 under CVSS 3.1, reflecting high confidentiality, integrity and availability impact on successful injection. Exploitation requires the nexus_reauth tool to be reachable and invokable and, per the PR:L vector, some low-level tool-invocation privilege rather than fully unauthenticated access, and the practical remote (AV:N) reach depends on whether the MCP server is actually network-exposed instead of local stdio only.
Authenticated command injection in SxDevOps 1.0/1.1 lets a signed-in user with host-task/command-generation rights defeat the platform's built-in dangerous-command filter and have arbitrary shell content reach managed hosts through the Command Handler (generate_host_task in backend/aiops/services.py). The pre-patch filter relied on substring matching of strings such as 'rm -rf', 'shutdown' and 'reboot', so shell metacharacters (; && || | backtick $() and newlines) could be smuggled into the 'command' argument to chain or substitute commands. Exploitation requires valid credentials plus at least one managed host configured to receive tasks, and no public exploit code has been identified at time of analysis; the vendor was contacted early and shipped a fix under commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9, making this a lower-priority safety-filter bypass rather than an unauthenticated takeover, consistent with the independent assessment scoring it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Command injection in SxDevOps 1.0 and 1.1 allows a high-privileged, authenticated operator to escape intended command restrictions when running TASK_RUN_COMMAND host tasks, because the user-supplied 'command' value is passed without neutralization to paramiko.SSHClient.exec_command in backend/ops/host_tasks.py (CWE-77). Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) the attacker must already hold a role permitted to create and execute host tasks, so the practical gain is bypassing command constraints via shell metacharacters (';', '&&', '||', '|', '$(', backticks, newlines) rather than obtaining access the operator lacks. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor shipped a fix (commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9) after being contacted early in the disclosure process.
Command injection in SxDevOps 1.0 and 1.1 lets an authenticated user who can manage MCP STDIO server configurations run arbitrary operating-system commands on the host by supplying shell metacharacters in the endpoint_or_command field, which is passed unchecked to subprocess.Popen. Exploitation requires high privileges (CVSS PR:H) because the attacker must be able to create or modify MCP STDIO server entries, and the feature must be reachable on an unpatched 1.0/1.1 build; there is no public exploit identified at time of analysis and no confirmed active exploitation. The issue is rated moderate by the independent assessment (CVSS:3.1 base 7.2) and is fixed upstream in commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9, which the vendor released after being contacted.
OS command injection in the Spatie Scotty developer CLI (through v1.4.4) lets a malicious 'host' value in a Scotty @servers configuration directive break out of the local shell and execute arbitrary commands when a victim runs the Doctor command. Because the host string is interpolated unescaped into Process::fromShellCommandline, shell metacharacters such as ';' and '${IFS}' in a crafted host are interpreted by the local shell rather than passed literally to ssh. This is a local CLI tool, so exploitation requires the attacker to get malicious configuration in front of the victim and the victim to subsequently invoke Doctor (checkSshConnectivity or checkRemoteTools), and any injected commands run only with the victim's own user privileges; no public exploit code has been identified at time of analysis, and vendor CVSS 4.0 rates this 5.3 with current exploit maturity unproven (E:X).
Authenticated command injection in IBM Cloud Pak for Data 5.1.2 lets a network-reachable, low-privileged user run arbitrary operating-system commands with elevated privileges on the underlying system. The flaw is an improper-neutralization-of-special-elements issue (CWE-78) in how user-supplied input is validated before being passed to a shell, and it rates CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning full loss of confidentiality, integrity and availability on the affected host once the attacker has any valid account. IBM has published a fix via its support advisory; no public exploit code has been identified at the time of analysis and there is no confirmation of active exploitation (CISA KEV).
Remote command injection in marcopiovanello yt-dlp-web-ui up to v4 lets a remote attacker (CVSS 4.0 vector records PR:N/UI:N, i.e. unauthenticated and no user interaction) abuse the params argument processed by NewGenericDownload in server/internal/downloaders/generic.go to inject arbitrary yt-dlp flags and shell metacharacters into the spawned download command. Publicly available exploit code exists - the flaw was publicly disclosed alongside the CVE, so any network-reachable instance of the generic download feature is a realistic target; there is no indication of confirmed active exploitation (not in CISA KEV). An upstream fix commit (c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897) replaces the previous weak sanitizer with a strict allowlist of yt-dlp flags, but no tagged patched release version is confirmed in the available data, so operators must either track the commit or restrict exposure.
Command injection in Microsoft Copilot allows an attacker to disclose confidential information when a victim invokes Copilot on attacker-controlled content containing improperly neutralized special elements. Exploitation requires the victim to trigger Copilot against the malicious content (UI:R) and depends on precise crafting to defeat the assistant's neutralization logic (AC:H), so it cannot be triggered unilaterally by the attacker, though no authentication is required of the attacker (PR:N). The flaw crosses a security boundary to expose highly confidential data with no integrity or availability impact (CVSS 3.1 base 6.1; S:C/C:H/I:N/A:N); there is confirmed actively exploited (CISA KEV) - no public exploit identified at time of analysis, and the underlying service has been remediated server-side, making residual real-world risk moderate and skewed toward opportunistic data theft rather than mass exploitation.
Authenticated OS command injection in Dromara mayfly-go through version 1.11.5 allows a low-privileged user who holds the machine:script:run permission and tag access to a target machine to execute arbitrary operating-system commands on that machine via the params argument of the RunMachineScript handler. No admin account is required, and publicly available exploit code exists (a public gist referenced in the CVE record), though there is no CISA KEV confirmation of active exploitation. The attack is remote, low complexity, and requires no user interaction, but it is gated by the two authorization grants and by the target machine's script template containing a {{.param}} placeholder where the unsanitized input is substituted before reaching the SSH execution layer.
Path-racing and shell-invocation weaknesses in the MidnightBSD mport package manager (all versions prior to 2.7.8) let a local, low-privileged attacker who can write to a participating package cache or staging path redirect privileged fetch, cache-clean, and install-related side effects outside the intended cache, and potentially influence command-line interpretation during privileged helper execution. The flaw spans libmport/fetch.c, clean.c, util.c, bundle_read_install_pkg.c, delete_primative.c, and libexec/mport.create/mport.create.c, and only becomes exploitable when a privileged mport operation runs concurrently so the attacker can win a timing-sensitive race; there is no remote reach and no public exploit identified at time of analysis. Because it requires local access, write permission on a shared cache/staging directory, and a hard-to-win race against a privileged process (AC:H, AT:P), the realistic risk is low-to-moderate despite the command-injection framing, and upgrading to 2.7.8 resolves it.
OS command injection in the IPsec Open API endpoint of Cisco Identity Services Engine (ISE) allows an authenticated, remote attacker holding valid administrative credentials to run arbitrary commands on the underlying operating system, and Cisco notes the obtained privilege level can be escalated easily to root. Exploitation is constrained to ISE nodes that have more than one network interface and that have one of those interfaces configured as an active IPsec tunnel, so default single-interface deployments without IPsec are not exposed; no public exploit code was identified at time of analysis. Although the CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N), Cisco has explicitly assigned a Security Impact Rating of High because of the short path from the achieved privilege level to root, making the raw numeric score a poor indicator of real-world severity.
Command injection in the web-based management interface of Cisco ThousandEyes Virtual Appliance allows an authenticated remote attacker with valid administrative credentials to save configuration details containing malicious values, leading to arbitrary OS command execution as root. Affected Cisco ThousandEyes Enterprise Agent versions per EUVD include 4.0, 4.1, 4.2, 4.4.2, 4.4.3, 4.4.4, 5.0, 5.1, 5.1.2, 5.1.3, and 5.2.0, and the primary limitation is the PR:H requirement for admin access. No public exploit identified at time of analysis, and the independent assessment characterizes this as a real but low-urgency issue.
Command injection (CWE-78) in HP's HPLIP (HP Linux Imaging and Printing) software enables an unauthenticated local user to execute commands or modify files with high integrity impact (VI:H) after active user interaction, matching HP's CVSS 4.0 score of 6.8 (AV:L/AC:L/PR:N/UI:A/VC:L/VI:H/VA:L) and the independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:R/C:L/I:H/A:L). The HP security bulletin HPSBPI04151 bundles this issue with other externally reported HPLIP flaws that could lead to remote code execution, privilege escalation, denial of service, or information disclosure, but the exact vulnerable component is not disclosed. No public exploit code or CISA KEV entry is identified at time of analysis, and the local vector plus mandatory user interaction prevents triggering without a user processing attacker-supplied input.
Authenticated command injection in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways (9.4.x, 9.5.x, 9.6.x and 9.7.0.0) lets a remote user who already holds limited access privileges submit specially crafted input that is passed to the underlying operating system, resulting in arbitrary command execution with elevated privileges or a denial-of-service condition on the appliance. The vendor-assigned CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) frames this as an availability-weighted, post-authentication issue rather than a pre-auth compromise. No CISA KEV listing, EPSS score or public proof-of-concept was supplied, so exploitation status is 'no public exploit identified at time of analysis'.
OS command injection in the exportOvpn handler of the TOTOLINK X5000R router firmware (9.1.0cu.2089_B20211224 and potentially other versions) allows an authenticated web-UI user to inject shell metacharacters through the 'filetype' argument supplied to /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user, resulting in commands executed with the privileges of the underlying CGI process. The flaw is remotely reachable (CVSS 4.0 AV:N/AC:L/AT:N/PR:L/UI:N) and publicly available exploit code exists, so any X5000R with an exposed or weakly-credentialed management interface should be treated as at risk. Impact per the supplied vector is limited (VC:L/VI:L/VA:L) but on an embedded device a successful injection typically yields full control of the appliance and its configuration.
Command injection in the D-Link DSL-3782 (firmware 2016-07-28) allows authenticated network attackers to execute arbitrary operating system commands by injecting shell metacharacters into the Addr argument of the Diagnostics web interface endpoint at /cgi-bin/New_GUI/Set/Diagnostics.asp. A public proof-of-concept exploit is available on GitHub, and the device is almost certainly end-of-life with no patch forthcoming from D-Link. The provided CVSS 4.0 score of 2.1 significantly understates the true impact, as command injection on embedded routers typically yields full root-level OS control of the device.
OS command injection in SabyasachiRana WebMap's nmap_newscan() function permits remote attackers to execute arbitrary shell commands by injecting metacharacters through the unsanitized target and params arguments in the New Nmap Scan Handler (functions_nmap.py). All repository commits up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25 are affected, and the flaw is exploitable without authentication per the CVSS PR:N vector. A public proof-of-concept exploit is available and a silent upstream patch has been committed without a formal security advisory.
Authenticated command injection in IBM i Access Family releases 1.1.2.0 through 1.1.9.15 allows a logged-in user to run arbitrary operating-system commands under their own normal user privileges by supplying a session file whose contents are parsed without proper input validation. Because the injected commands execute only with the rights of the invoking account, the confidentiality, integrity and availability impact is limited rather than system-wide. No public exploit code or CISA KEV activity is identified at time of analysis, and no EPSS score was supplied with the input data.
IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.15 fail to properly validate user-supplied input in the emulator macro 'RunProgram' action, allowing an authenticated user to execute arbitrary operating-system commands with normal user privileges through a crafted macro. The flaw is a classic OS command injection (CWE-78) reachable over the network at low complexity, but it grants no privilege escalation beyond the invoking user's own rights, which is why IBM rates it 6.3 rather than critical. There is no public exploit code and no CISA KEV listing at time of analysis, so this is a hardening and lateral-movement concern rather than an urgent emergency patch item.
Improper input validation in the STRPCCMD CL command handling of IBM i Access Client Solutions (IBM i Access Family 1.1.2.0 through 1.1.9.15) lets an authenticated IBM i user inject and execute arbitrary operating-system commands on the machine running the ACS client, using only that user's normal privileges. IBM rated the issue CVSS 6.3 (AV:N/AC:L/PR:L/UI:N, low confidentiality/integrity/availability impact) and classifies it as OS command injection (CWE-78). There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed as active.
OS command injection in MacCMS10 2026.1000.4055 allows an authenticated administrator to execute arbitrary system commands on the underlying server via the Template Handler component by submitting a crafted URL-encoded path parameter. A public proof-of-concept exploit exists, referenced through a GitHub issue report against the project repository. No vendor patch has been released; the project maintainer has not responded to the disclosure.
OS command injection in D-Link DWR-M921 firmware 1.1.52 exposes the router to remote arbitrary command execution via the WPS configuration endpoint. The `targetAPSsid` parameter passed to `/boafrm/formWsc` is not sanitized before being incorporated into a system-level command within the Boa embedded web server, allowing an authenticated administrator to execute arbitrary OS commands on the underlying embedded Linux system. A public proof-of-concept exploit authored by H3rmesk1t is available on GitHub, lowering the barrier for abuse significantly. No active KEV listing is present at time of analysis.
Command injection in D-Link DWR-M921 firmware 1.1.52 enables authenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the `devicename` parameter of the `/boafrm/formDiskPartition` web management endpoint. The firmware passes this parameter unsanitized to a C `system()` call, granting shell-level access to the device's underlying OS. A public proof-of-concept exploit has been disclosed on GitHub by researcher H3rmesk1t, confirming exploitability for any attacker in possession of valid administrative credentials.
OS command injection in D-Link DWR-M921 router firmware 1.1.52 permits authenticated remote attackers to execute arbitrary operating system commands by manipulating the sysCmd parameter submitted to the /boafrm/formsysCmd endpoint in the Boa embedded web server. Successful exploitation gives the attacker shell-level control over the device, enabling full compromise of routing, VPN, and wireless functions. A public proof-of-concept exploit has been disclosed on GitHub; no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.
Cross-site scripting in the Image Management component of Contec SolarView Compact (models sv-cpt-mc310 and sv-cpt-mc310f) enables authenticated attackers to inject malicious script that can trigger arbitrary OS command execution on the underlying device. Reported by JPCERT/CC (JVNVU97753461) with a Contec vendor advisory, the vulnerability chains CWE-79 XSS with a command injection pathway, making it more dangerous than its CVSS 4.0 score of 5.1 suggests. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored cross-site scripting in Contec SolarView Compact (sv-cpt-mc310 and sv-cpt-mc310f) solar power monitoring appliances affects the Schedule Settings and Mail Send Setting pages of the web management interface. An attacker who injects a malicious script into these configuration fields can cause arbitrary OS command execution when a privileged user renders the poisoned page in an authenticated session. No public exploit has been identified at time of analysis, and the vendor has issued a security advisory coordinated through JPCERT/CC under JVNVU97753461.
OS command injection in 0x4m4 HexStrike AI allows unauthenticated remote attackers to execute arbitrary shell commands by supplying metacharacter-laden values in the additional_args, target, username, password, scan_type, or payload fields of the /api/tools/* API endpoints, which pass these values directly into subprocess.Popen(shell=True) without sanitization. The PR diff confirms the flaw spans at least 97 API endpoints covering nmap, gobuster, nuclei, nikto, ffuf, and feroxbuster executors in hexstrike_server.py. A publicly available proof-of-concept exploit exists (GitHub issue #224) and a partial fix is in progress via PR #266, though PR #266 only addresses the additional_args parameter and may leave other injectable fields (target, username, password, scan_type, payload) unpatched.
OS command injection in HackingBuddyGPT up to version 0.5.0 allows a remote low-privileged attacker to execute arbitrary commands on the host running the tool by manipulating input processed by the `ssh_run_command` function in `src/hackingBuddyGPT/extensions/ssh_run_command.py`. The function fails to sanitize shell metacharacters before constructing and executing SSH commands, creating a classic CWE-78 unsanitized-input-to-shell scenario. A publicly available proof-of-concept exploit exists (GitHub issue #150), and the maintainer has not responded to the disclosure; no patch has been released as of this analysis.
OS command injection in HexStrike AI's Execute Endpoint allows remote unauthenticated attackers to execute arbitrary operating system commands on the server by manipulating the `code` or `script` parameters in `hexstrike_server.py`. The affected product is the rolling-release version of 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04. A public exploit has been disclosed via a GitHub issue report; the vendor has not yet responded, and no patch is available.
OS command injection via prompt injection in GH05TCREW PentestAgent's LocalRuntime allows a malicious target host to execute arbitrary shell commands on the operator's workstation. When the agent scans an adversary-controlled target, response content such as HTTP bodies, SSH banners, or DNS records flows unfiltered into the LLM's prompt context; a crafted payload steers the LLM into generating reverse-shell or persistence commands that LocalRuntime.execute_command() then runs with full operator-level privileges. A publicly available exploit exists (GitHub issue #91), and the upstream fix (PR #100) remains unmerged at time of analysis.
PentestAgent's MCP HTTP Server (up to commit cf882dabea3ed91cef016cdd115e5426315665a2) bound to all network interfaces (0.0.0.0) by default with zero authentication, allowing any remote attacker to call the `run_task` function in `interface/main.py` and execute arbitrary OS commands on the host running the agent. A public proof-of-concept is available via GitHub issue #90, and the fix (PR #101) adds bearer token auth and changes the default bind address to 127.0.0.1, but the pull request had not yet been merged at time of analysis. The CVSS 4.0 score of 6.9 substantially understates impact given that full unauthenticated OS command execution is achievable.
OS command injection in webgjc web_robot versions 2.4.0, 2.5.0, and 2.8.0 enables remote attackers to execute arbitrary operating system commands by supplying malicious input through the case_name parameter handled by the controller_listen or controller_recover functions in py/web.py. A publicly disclosed proof-of-concept exploit exists, the vendor failed to respond to responsible disclosure, and no patch has been released. The reported CVSS 4.0 base score of 5.3 reflects conservative impact ratings that appear inconsistent with the true scope of OS command injection on an unpatched host.
Command injection in LB-LINK AC1900_AZ2 router firmware V1.0.2 allows adjacent-network actors to inject OS commands through shell metacharacters passed to the bs_SetLimitCli_info function within libshare.so, triggered via a POST request to /goform/set_LimitClient_cfg. The vulnerability is notable for an internal contradiction: the CVSS vector assigns PR:H (administrative privileges required), yet the description explicitly frames the attack scenario as one where the actor lacks administrative access but can reach the endpoint - suggesting the endpoint may be accessible to lower-privilege or unauthenticated callers in certain deployments. No patch has been identified and no public exploit is confirmed at time of analysis beyond the researcher's GitHub write-up.
OS command injection in Palo Alto Networks Checkov by Prisma Cloud allows a local low-privileged user to execute arbitrary commands within the Checkov scanning process. Because Checkov is routinely deployed inside CI/CD pipelines holding cloud credentials and infrastructure deployment permissions, successful exploitation can propagate beyond the scanning host to affect subsequent systems at high confidentiality, integrity, and availability impact. No public exploit has been identified and Palo Alto Networks' own environmental scoring (1.1) reflects both the local-only attack vector and currently unreported exploitation activity.
Command injection in Palo Alto Networks PAN-OS allows an authenticated administrator to escape CLI restrictions and execute arbitrary OS commands as root via CWE-78 weaknesses in the Luna Hardware Security Module integration pathway. Exploitation is doubly gated: the attacker must hold administrative credentials with CLI access, and the target device must be configured with a Luna HSM - a niche cryptographic hardware module rarely deployed outside regulated or high-assurance environments. Panorama, Cloud NGFW, and Prisma Access are explicitly confirmed unaffected; vendor-released patches exist across all supported PAN-OS branches, and no public exploit or active exploitation has been identified.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to inject and execute scripts, resulting in high confidentiality impact. Affected are SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing.
Command injection in Dell PowerScale OneFS allows a local attacker with admin-level privileges to escalate to root, achieving full system compromise across confidentiality, integrity, and availability. Affected versions span three distinct release trains: 9.5.0.0-9.7.1.0, 9.8.0.0-9.10.1.0, and 9.11.0.0-9.14.0.1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the attack requires pre-existing local administrative access, substantially limiting the attack surface to insider threats or post-compromise scenarios.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 permits a local, low-privileged attacker to execute arbitrary OS commands on the affected host, potentially exposing sensitive configuration data and credentials stored on the appliance. Both physical Appliance deployments (prior to 5.36.00.16) and software Application deployments (prior to 5.36.00.00) are affected, as confirmed in Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified; Dell has released corrective patches for both form factors.
Command injection in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance and Application variants - permits unauthenticated remote attackers to perform script injection via network-accessible interfaces. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements in a Command), though Dell's own CVSS scoring constrains the impact to limited confidentiality exposure (C:L, I:N, A:N), suggesting the injected scripts are not fully executed as OS-level commands but rather reflected or partially evaluated. No public exploit code and no CISA KEV listing have been identified at time of analysis.
OS command injection in Okta Access Gateway (versions prior to 2026.9.1) allows an authenticated high-privileged local user to inject shell metacharacters into SNMP configuration values, causing a privileged backend script to execute arbitrary OS commands as root. The vulnerability (CWE-78) stems from failure to sanitize user-supplied configuration data before incorporating it into OS command construction. No public exploit or active exploitation has been identified; a vendor-released patch is available.
Command injection (CWE-77) in Visual Studio Code versions prior to 1.136.2 and GitHub Copilot enables a network-based attacker without authentication to trigger disclosure of sensitive information when a targeted developer interacts with specially crafted content. The attack requires high complexity (AC:H) and user interaction (UI:R), yielding a CVSS 5.3 Medium score that reflects real exploitation barriers. No public exploit code and no CISA KEV listing have been identified at time of analysis.
OS Command Injection (CWE-78) in Dell Secure Connect Gateway 5.0 permits low-privileged remote attackers to execute arbitrary operating system commands against both the Appliance and Application deployment variants. Affected versions are SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00; Dell has released fixes under advisory DSA-2026-382. No public exploit code or CISA KEV listing has been identified at time of analysis.
Command injection in the D-Link DIR-895L router's DHCP server daemon allows a network-adjacent attacker to execute arbitrary OS commands by crafting a malicious Hostname option in a DHCP request. The vulnerable code path is in the `sendACK` function of `udhcpcd/serverpacket.c`, where the client-supplied Hostname field is processed without sanitization, leading to shell injection. A public proof-of-concept exploit exists targeting firmware version A1_102b07, and no vendor patch has been identified at time of analysis.
Parameter injection in IBM i 7.3 through 7.6 allows a local authenticated attacker to inject malicious parameters into Control Language (CL) commands by exploiting improper neutralization of special elements (CWE-78). The flaw requires local access with low-level privileges and produces limited confidentiality and integrity impacts without availability consequence, consistent with the CVSS 4.4 Medium rating. IBM has released a patch via their support portal, and no public exploit code or active exploitation has been identified at time of analysis.
Command injection in the MongoDB extension for Visual Studio Code allows a remote attacker, via social engineering, to inject arbitrary shell characters into a terminal command composed by the extension when a developer opens its integrated shell feature against an attacker-controlled connection target. The extension fails to neutralize special characters from user-supplied MongoDB connection strings before embedding them in the command line, and the confirmation dialog shown to the developer does not render the injected payload, preventing visual detection. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the multi-step social-engineering requirement is the primary barrier to exploitation.
Command injection in Dell SmartFabric OS10 Software (versions prior to 10.5.6.14) allows a remote authenticated administrator to execute arbitrary OS commands on the underlying network operating system. Classified under CWE-77, the flaw requires high privilege and high attack complexity, yielding a vendor-assigned CVSS score of 5.0 - reflecting a substantially elevated bar for exploitation compared to typical network-reachable command injection. No public exploit code or active exploitation has been identified at time of analysis; Dell has released a patched version.
Command injection in Dell SmartFabric OS10 Software (versions prior to 10.5.6.14) allows a remotely-authenticated, high-privileged attacker to execute arbitrary OS commands via the network-accessible management interface. Dell disclosed and patched the issue through advisory DSA-2026-322, with version 10.5.6.14 as the confirmed fix. No public exploit code or active exploitation has been identified; the high-privilege and high-complexity prerequisites substantially constrain the realistic threat surface.
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administrator with adjacent network access to execute arbitrary operating system commands, leading to complete compromise of the affected system. The vulnerability spans at least eight WSO2 middleware products - including API Manager, Identity Server, Open Banking components, Traffic Manager, Universal Gateway, and API Control Plane - all of which share the Carbon Console administrative layer. The CVSS scope-change flag (S:C) indicates that successful exploitation extends impact beyond the WSO2 application boundary to the underlying host and potentially adjacent systems.
Authenticated OS command injection in CRMEB up to version 6.0.0 allows a backend administrator to execute arbitrary operating system commands by submitting malicious PHP code through the Custom Scheduled Task Feature's customCode parameter, which is passed directly to PHP's eval() function at /adminapi/system/crontab/save. The vendor characterizes this as intentional debug-only functionality, but the isSafePhpCode blacklist filter provides no meaningful containment against determined abuse. A public proof-of-concept exploit is available on GitHub, lowering the barrier to exploitation for any attacker who has obtained admin credentials.
OS command injection in Westermo WeOS 5.x (versions 5.24 and later) allows an authenticated administrator to execute arbitrary shell commands on the underlying device operating system by supplying a crafted media definition through the management interface. The scope change component of the CVSS vector confirms exploitation breaks out of the management application context into the OS layer, enabling full device compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CISA issued ICS advisory ICSA-25-261-01, elevating concern for operators in critical infrastructure sectors.
Command injection in ICP DAS UA-2200 and UA-5200 industrial IoT gateways (firmware up to 20260704) allows a network-authenticated attacker to execute arbitrary OS commands by manipulating the ParameterArray argument in the SetHostname CGI API endpoint. A publicly available proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving users without an official patch or mitigation guidance. Given that these are OT/ICS-class devices, successful exploitation may impact industrial operations, data integrity, and device availability beyond the immediate device itself.
OS command injection in Edimax BR-6214K firmware 1.40 allows an authenticated administrator to execute arbitrary commands on the router's underlying embedded OS by supplying shell metacharacters in the `pingstr` argument of the `asp_setPing` web endpoint. A public proof-of-concept exploit has been released on GitHub, and the vendor has not responded to disclosure nor issued a patch. Despite the low CVSS 4.0 score of 2.0 - driven entirely by the PR:H authentication requirement - successful exploitation yields root-level command execution on the device, making the practical impact significantly higher than the score suggests for any attacker who already possesses admin credentials.
OS command injection in Edimax BR-6214K firmware version 1.40 allows a remote authenticated administrator to execute arbitrary operating system commands by supplying a crafted value to the ateFunc parameter of the wlanMP.asp endpoint, which passes it unsanitized to a system() call. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for post-authentication exploitation. No vendor patch exists and the vendor did not respond to disclosure; no CISA KEV listing means active exploitation has not been confirmed by US government sources, though the unpatched status combined with public PoC availability elevates near-term risk.
OS command injection in the Diem CMS Administrative Console (diem-project/diem ≤ 5.1.3) allows authenticated administrators to execute arbitrary operating system commands on the host server via the unsanitized `dm_command` argument of the `executeCommand` function in `dmAdminPlugin/modules/dmConsole/actions/actions.class.php`. Publicly available exploit code exists via GitHub issue #447, and the project maintainers have not responded to the responsible disclosure report. The vulnerability is not in CISA KEV, but the unpatched status combined with available exploit code elevates urgency for any organization still running this abandoned software.
Git textconv injection in GitList 2.0.0 enables remote code execution on the server by exploiting repository-controlled `.gitattributes` textconv filter definitions. When a user browses a commit diff or blame view, GitList invokes `git show` or `git blame` without the `--no-textconv` guard, causing git to execute attacker-committed shell scripts as the web server process. A public proof-of-concept exists embedded in the patch's own regression test suite; the vulnerability is absent from the CISA KEV catalog at time of analysis.
SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the transport `name` configuration option to inject arbitrary SMTP commands by embedding CRLF sequences in the value. The EHLO, HELO, and LHLO commands are constructed via direct string concatenation in lib/smtp-connection/index.js without sanitization, enabling unauthorized email sending, spoofing, and phishing through the configured SMTP relay. A proof-of-concept is publicly available in the GHSA advisory; no KEV listing is present, indicating exploitation has not been confirmed at mass scale at time of analysis.
Command injection in the D-Link DIR-825M router (firmware 1.1.8) allows network-adjacent authenticated attackers to execute arbitrary OS-level commands by manipulating the `sysCmd` argument submitted to the `/boafrm/formSysCmd` endpoint, processed by function `sub_456CF4` without sanitization. A public proof-of-concept exploit exists and was published alongside the VulDB disclosure. The provided CVSS 4.0 score of 2.1 appears to severely understate the real impact - command injection in a router's System Command Execution interface typically yields full OS compromise, not low-severity system impact.
Command injection in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 allows network-accessible attackers with low-privilege credentials to execute arbitrary OS commands by manipulating the 'ussd' parameter in the setUssd function exposed via /cgi-bin/cstecgi.cgi. A proof-of-concept exploit has been publicly released on GitHub, lowering the skill threshold for exploitation. On embedded router firmware, CGI processes typically run with root or near-root privileges, meaning successful exploitation likely yields full device control - a substantially higher real-world impact than the provided CVSS 4.0 score of 2.1 suggests.
OS command injection in AlexGladkov claude-in-mobile 3.10.2 allows a local low-privileged attacker to execute arbitrary shell commands by supplying metacharacter-laced parameters to the tool's ADB and iOS simulator CLI subsystem. The Rust CLI modules (android.rs, ios.rs) interpolated caller-supplied strings - package names, permission identifiers, XML filenames, preference keys, SQLite database paths, and relative file paths - directly into device-side sh -c invocations without sanitization. A public proof-of-concept exists (GitHub issue #40), and a vendor-released patch (v3.10.3) is available.
Command injection in Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build) allows an adjacent-network attacker holding administrator credentials to execute arbitrary OS commands with root privileges. The flaw is in the update_interface_png SET handler within /usr/bin/webmgnt, where the display_name parameter is unsanitized and concatenated via sprintf() directly into a shell command string passed to system(). A public proof-of-concept is available on GitHub; EPSS at 0.17% (6th percentile) indicates no current widespread exploitation, and the vulnerability is not listed in CISA KEV.
Command injection in Wgcloud 3.6.4 exposes the server to remote code execution: the `content` parameter is unsanitized and directly concatenated into a Java `ProcessBuilder` call, allowing an adjacent-network attacker to inject arbitrary OS commands. The CWE-77 classification and the researcher's own proof-of-concept - titled RCE.md - confirm arbitrary code execution capability, making the submitted CVSS of 4.3 (C:L only) a significant understatement of real impact. No public exploit in CISA KEV, but publicly available exploit code exists per the researcher's GitHub disclosure.
OS command injection in Comfast CF-WR630AX firmware v.2.7.0.2 allows an adjacent-network attacker with administrator-level credentials to execute arbitrary OS commands through the device's web management interface and CGI endpoint via unsanitized parameters. A public proof-of-concept exploit is available on GitHub, though EPSS probability remains very low (0.19%, 9th percentile), indicating minimal observed exploitation activity. No active exploitation has been confirmed by CISA KEV, and the AV:A/PR:H CVSS vector materially constrains the realistic attacker population.
Remote command injection in TOTOLINK N600R firmware 4.3.0cu.7647_B20210106 allows unauthenticated network attackers to execute arbitrary OS commands by supplying shell metacharacters in the `ntp_server` parameter to the `getCurrentTime` handler at `/cgi-bin/cstecgi.cgi`. A public proof-of-concept demonstrating popen-based injection is available on GitHub, confirmed by the CVSS 4.0 E:P exploit maturity indicator, meaning exploitation requires minimal attacker skill. No vendor-released patch has been identified in available intelligence, leaving internet-exposed devices unmitigated.
OS command injection in zackees/transcribe-anything (versions up to 4.1.0) allows remote attackers to execute arbitrary system commands by supplying a crafted URL argument to the `ytdlp_download` function in `src/transcribe_anything/ytldp_download.py`. The CVSS 4.0 score is 2.9 - low - primarily because attack complexity is rated High, meaning exploitation requires specific conditions to align rather than trivial one-shot delivery. A publicly available proof-of-concept exploit exists via GitHub issue #137, and the vendor has not responded to the coordinated disclosure, leaving no patch available at time of analysis.
Argument injection in the Okta Privileged Access client allows a crafted SSH target username beginning with a hyphen to be interpreted as a command-line option by the underlying SSH subprocess. Organizations using Okta Privileged Access for SSH session brokering are affected when a user initiates a connection to a target whose username has been set to a hyphen-prefixed value. If exploited, an attacker who can influence the target username definition could cause the SSH client to process injected options, achieving high confidentiality impact. No public exploit code is identified at time of analysis, and CISA KEV does not list this CVE.
OS command injection in NVIDIA OpenShell for Linux's sandbox exec handler allows a low-privileged, network-accessible attacker to inject and execute arbitrary OS commands outside the intended sandbox boundary. All versions are affected per CPE data (cpe:2.3:a:nvidia:openshell:*:*:*:*:*:*:*:*), with confirmed potential impact spanning code execution, information disclosure, and data tampering. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Command injection in NVIDIA UFM Enterprise's IBDiagnet API allows an authenticated administrator with adjacency-level network access to execute arbitrary OS commands on the host system, potentially achieving full compromise. All major release trains are affected - GA, LTS 2023, LTS 2024, and LTS 2025 - as confirmed by NVIDIA's own advisory and NVD CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world opportunistic risk constrained by the high privilege and network adjacency prerequisites.
Command injection in NVIDIA UFM Enterprise's user management component enables an authenticated administrator to execute arbitrary OS-level commands by sending a crafted API request, spanning all active release tracks (GA, LTS 2023, LTS 2024, LTS 2025). Successful exploitation can yield full code execution on the UFM host, privilege escalation beyond the administrative role, and disclosure of sensitive InfiniBand fabric management data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the adjacent network attack vector (AV:A) constrains the realistic attacker population to those with both admin credentials and access to the management network segment.