Command Injection
Monthly
OS command injection in Microchip TimeProvider 4100 Grandmaster (firmware versions before 2.5) allows authenticated attackers on adjacent networks to execute arbitrary system commands with high privileges, leading to complete device compromise. The vulnerability requires low attack complexity and low privileges, with exploitation probability at 0.28% (EPSS), indicating moderate real-world risk. No public exploit identified at time of analysis, but the adjacent network requirement and low complexity make this readily exploitable in targeted attacks against time synchronization infrastructure.
OS command injection in Microchip TimeProvider 4100 Grandmaster allows authenticated adjacent network attackers to execute arbitrary system commands with elevated privileges on firmware versions prior to 2.5. The vulnerability requires low attack complexity and low privileges, enabling complete compromise of device confidentiality, integrity, and availability. EPSS exploitation probability is low (0.28%, 51st percentile) with no public exploit identified at time of analysis, though the straightforward attack vector presents significant risk to network time infrastructure in enterprise environments.
Authenticated OS command injection in Ilevia EVE X1 Server firmware versions up to and including 4.7.18.0.eden allows any user who can log in to the web management interface to execute arbitrary operating-system commands on the device. Multiple web-accessible PHP scripts pass user-supplied input directly into exec() calls without sanitization (CWE-78), so the injected commands run with the privileges of the web server process, giving full compromise of confidentiality, integrity and availability of the appliance; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network reachability, low attack complexity and a mandatory authentication prerequisite. Exploitation is conditionally gated rather than broad: EPSS is 1.99% (80th percentile), there is no CISA KEV listing, and no public exploit code has been confirmed at time of analysis even though a Zero Science Lab advisory (ZSL-2025-5966) documents the issue. The vendor has declined to remediate, so exposure depends entirely on whether TCP port 8080 is reachable from untrusted networks and on how well web-interface accounts are controlled.
Unauthenticated OS command injection in the Ilevia EVE X1 Server web interface (firmware versions up to and including 4.7.18.0.eden) allows anyone who can reach TCP port 8080 to execute arbitrary operating-system commands with the privileges of the web service, by sending crafted input to the mbus_build_from_csv.php script. The flaw is rated CVSS 4.0 9.3 (CVSS 3.1 8.8/9.8-equivalent AV:N/PR:N/UI:N with full confidentiality, integrity and availability impact), publicly available exploit code exists (Zero Science Lab ZSL-2025-5962), and EPSS is 7.62% (94th percentile) - although there is no CISA KEV confirmation of active exploitation. Ilevia has declined to service the vulnerability, so there is no vendor-released patch identified at time of analysis and exposure is governed entirely by whether port 8080 is reachable from untrusted networks.
Command injection in Zoom clients for Windows allows an authenticated user with network access to trigger a disclosure of information from a vulnerable client, affecting Zoom Workplace Desktop, the Zoom Meeting SDK, Zoom Rooms, and Zoom Workplace VDI. Exploitation requires a valid authenticated session (CVSS PR:L) but no user interaction (UI:N), and the assessed impact is confined to confidentiality (C:H) with no integrity or availability effect. There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and EPSS is 1.82% (78th percentile) - a moderate-priority issue rather than a top-tier emergency.
Command injection in F5OS-A on F5 rSeries appliances allows a highly privileged authenticated local operator to execute arbitrary system commands during FIPS HSM initialization if the initialization password contains shell metacharacters; this can cross a security boundary and cause the HSM to fail to initialize. The issue is local-only (AV:L) and requires high administrative privileges (PR:H), so it is limited to trusted insider or already-compromised admin contexts, and the independent assessment rates real-world risk LOW-to-MODERATE. EPSS is 0.18% (7th percentile), and no public exploit identified at time of analysis.
Appliance mode restrictions in F5 BIG-IP can be escaped by a highly privileged, authenticated administrator who already holds SCP and SFTP access to the device, allowing undisclosed commands to run outside the restricted shell that Appliance mode is designed to enforce. The flaw is a command-injection class issue (CWE-78) in the BIG-IP platform and affects the broad set of BIG-IP modules (APM, ASM/AWAF, AFM, Analytics, AAM, CGNAT, CIS, and others) only when the system is deliberately configured in Appliance mode - a non-default hardened lockdown state. Exploitation requires PR:H per the CVSS vector, meaning no unauthenticated or low-privileged path exists, and there is no public exploit identified at time of analysis; EPSS is low at 0.44% (37th percentile), and the CVE is not listed in CISA KEV. The net effect is a confidentiality and integrity impact (high C/I, no availability impact) for environments that tier a hardened Appliance-mode posture against trusted administrators.
Authenticated path traversal in Buffalo WXR9300BE6P series router firmware prior to Ver.1.10 lets an administrator logged into the web management interface write files to arbitrary paths, and by overwriting specific files the attacker can escalate to arbitrary OS command execution on the device. The attack is network-deliverable but gated behind a valid administrative session (CVSS PR:H), so real-world exposure is limited to insiders or attackers who already obtained admin credentials through default/weak passwords, credential reuse, CSRF, or an internet-exposed management panel. No public exploit code has been identified and the CVE is not in CISA KEV; EPSS is 0.53% (43rd percentile), making this a credible but not top-tier priority - vendor-released patch: Ver.1.10.
OS command injection in the FreePBX Endpoint Manager module's Network Scanning feature allows a highly privileged, authenticated user to execute arbitrary operating system commands as the asterisk service account, affecting Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6. The CVSS 4.0 base score is 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L), and our independent assessment concurs with high confidentiality and integrity impact but only low availability impact, since this is effectively post-authentication command execution rather than a pre-auth compromise. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS is low at 0.53% (43rd percentile), so the practical risk is concentrated in deployments where the Endpoint Manager commercial module is installed and its Network Scanning feature is reachable. Vendor-released patches exist: Endpoint Manager 16.0.92 and 17.0.6.
Authenticated remote code execution in FlowiseAI Flowise (v3.0.1 up to but not including 3.0.8, and later versions when 'ALLOW_BUILTIN_DEP' is enabled) lets a logged-in user break out of the nodevm sandbox by abusing the bundled Puppeteer and Playwright modules. Because a custom tool can specify an attacker-controlled browser binary path and launch parameters, executing that tool runs an arbitrary executable on the host outside the intended sandbox, yielding code execution in the host context. Publicly available exploit code exists; the flaw is not listed in CISA KEV, and it was mis-filed by the vendor as a duplicate of CVE-2025-26319 but is distinct.
Authenticated command injection in the web-based management interface of HPE network access point configuration services allows a remote attacker holding high-level administrative privileges to execute arbitrary commands on the access point's underlying operating system, resulting in full compromise of confidentiality, integrity, and availability of the device (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The PR:H requirement is the dominant limiting factor: exploitation is only possible after successful authentication to the management plane with administrative rights, so default-configuration devices are not reachable by unauthenticated users. EPSS is low at 0.89% (58th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis; the practical risk is therefore bounded by how tightly administrative access to the management interface is restricted.
Authenticated command injection in the command-line interface binary of HPE Aruba Networking AOS-10 Gateways and AOS-8 Controllers/Mobility Conductors lets an attacker who already holds high-privilege CLI credentials and has physical access to the appliance hardware escape the restricted CLI and execute arbitrary commands as a privileged user on the underlying operating system. The flaw carries a CVSS v3.1 score of 6.2 (CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so although confidentiality, integrity and availability impact is rated High, the vector is gated by two strong preconditions - physical access to the controller hardware (AV:P) and high-privilege authenticated access to the CLI (PR:H) - keeping real-world risk low. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is only 0.66% (50th percentile), consistent with a vulnerability that cannot be reached remotely.
Authenticated command injection in the ArubaOS (AOS-8) Controller and Mobility Conductor CLI allows a privileged administrator to execute arbitrary commands as a privileged user on the underlying operating system, achieving high confidentiality, integrity, and availability impact (CVSS 7.2). Exploitation requires valid privileged credentials (PR:H) and network reachability to the management CLI, and no public exploit has been identified; EPSS is 1.23% (68th percentile), indicating a moderate, non-emergency risk. The vendor has published an advisory (HPE docDisplay hpesbnw04957en_us) that should be consulted for fixed versions.
Authenticated command injection in the ArubaOS (AOS-8) Controller and Mobility Conductor CLI lets an attacker who already holds a privileged administrator-level CLI account execute arbitrary commands as a privileged user on the underlying operating system. The weakness is limited by its PR:H prerequisite - a valid high-privilege, network-reachable CLI session is required - so realistic exposure is confined to compromised admin credentials, reused/leaked administrator logins, or malicious insiders rather than unauthenticated outsiders. At time of analysis there is no CISA KEV listing and no public exploit code identified; EPSS sits at 1.23% (68th percentile), consistent with a genuine but moderate-priority issue rather than an emergency, and defenders should confirm the exact affected AOS-8 release trains against the HPE advisory because the CPE entries carry unversioned wildcards.
Authenticated attackers holding administrator privileges on Ivanti EPMM can inject OS commands through the admin panel and execute arbitrary code on the underlying server in versions prior to 12.6.0.2, 12.5.0.4, and 12.4.0.4. The flaw carries a CVSS base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and an EPSS probability of 20.35% (97th percentile), indicating elevated likelihood of exploitation activity, although no public exploit code or CISA KEV listing was identified at time of analysis. Because the prerequisite is an already-compromised administrative session, practical risk escalates where admin interfaces are reachable from untrusted networks or where credentials are reused.
Authenticated OS command injection in Ivanti Endpoint Manager Mobile (EPMM) allows a remote attacker with admin privileges to execute arbitrary OS commands and achieve remote code execution on versions before 12.6.0.2, 12.5.0.4, and 12.4.0.4. Exploitation requires a valid admin session (CVSS PR:H), and no public exploit has been identified at time of analysis; however, the EPSS score is 20.35% (97th percentile), indicating elevated risk. The impact is high, with potential for full compromise of the EPMM server.
OS command injection in the administrative panel of Ivanti Endpoint Manager Mobile (EPMM) enables remote code execution for an attacker who already possesses an authenticated admin session. The flaw affects versions prior to 12.6.0.2, 12.5.0.4, and 12.4.0.4; the CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N) because the high privilege prerequisite limits the attack surface. Despite the moderate base score, the EPSS score of 20.35% (97th percentile) indicates an unusually high exploitation probability, though no public exploit code or confirmed active exploitation was identified at time of analysis.
OS command injection in Fortinet FortiVoice allows an authenticated administrator to execute arbitrary operating-system commands on the appliance by sending crafted HTTP/HTTPS requests to the management interface or crafted CLI commands. Affected deployments are FortiVoice 7.2.0, 7.0.0 through 7.0.6, and versions before 6.4.10, and because the CVSS vector carries PR:H, the attacker must already hold privileged (administrative) access, making this a post-authentication issue rather than an unauthenticated remote compromise. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is modest at 1.32% (70th percentile), so this is a genuine but second-tier priority rather than an emergency, with the strongest risk driver being exposed or shared administrative credentials on the FortiVoice management interface.
OS command injection in the 3DEXPERIENCE Station Launcher App (releases R2022x through R2025x) allows an attacker to execute arbitrary code on the user's machine by supplying crafted input that the launcher processes, such as a malicious link or file. Exploitation requires the victim to run the affected launcher and interact with the attacker-controlled input (UI:R), with code executing locally under the user's privileges. The vendor CVSS vector indicates an authenticated context (PR:L), while the independent assessment scores it as unauthenticated (PR:N); no public exploit code or active exploitation has been identified at time of analysis.
OS command injection in the firmware update handler of the end-of-life D-Link DAP-2695 wireless access point (build 2.00RC131) allows remote attackers with administrative credentials to execute arbitrary OS commands on the device through the fwupdater_main routine in rgbin. Exploitation requires authenticated administrative access to the management interface (PR:H per the assessed vector), and because the product is no longer supported by D-Link, no vendor patch will be issued - mitigation depends entirely on restricting who can reach the admin interface. Publicly available exploit code exists (a technical write-up with PoC details is hosted on GitHub), and the EPSS score of 6.81% (94th percentile) indicates elevated relative attention despite the authentication prerequisite and limited, low-severity impact (C:L/I:L/A:L).
Improper input validation (CWE-20) in HCL Unica MaxAI Workbench, the AI component within HCL's Unica marketing suite, lets an authenticated low-privileged user plant crafted input in a field that is later rendered to a second user, resulting in reflected cross-site scripting rather than the server-side SQL injection or command injection implied by the vendor's generic description. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, base 3.5) limits the demonstrated impact to partial integrity loss with no confidentiality or availability effect, and exploitation requires both a valid low-privileged account and victim user interaction. Risk is low: EPSS is 0.50 percent (40th percentile), no publicly available exploit code and no CISA KEV entry were identified at time of analysis, and the breadth of the advisory text is not supported by the scored vector.
Arbitrary file upload in Mingsoft MCMS v6.0.1 enables remote code execution on the underlying server by uploading a crafted file - likely a JSP web shell - to a reachable endpoint. The NVD-assigned CVSS score of 6.5 with C:L/I:L impact subscores is materially inconsistent with the stated code execution impact, and this discrepancy should be independently verified. No public exploit has been confirmed as actively exploited per CISA KEV, though a Gist-based reference in NVD data may represent a proof-of-concept; EPSS is low at 0.28% (20th percentile), suggesting no widespread scanning or exploitation observed at time of analysis.
Crafted command input submitted to Microsoft 365 Copilot Chat can cause the hardened service to disclose sensitive information across a trust boundary, because the service fails to neutralize special command elements before interpreting user-supplied content (CWE-77). The flaw is reachable over the network with no authentication, no privileges, and no user interaction (CVSS 9.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), so any organization whose users rely on the hosted Copilot Chat service is exposed. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and EPSS is low at 0.57% (45th percentile); because this is a Microsoft-operated cloud service, the exposure window closes for all tenants once Microsoft completes server-side remediation.
Improper neutralization of special elements (CWE-77 command injection) in Microsoft 365 Copilot Chat allows an unauthenticated attacker to trigger information disclosure that crosses a scope boundary, yielding a CVSS 3.1 base score of 9.3 (Critical) with high confidentiality impact and low integrity impact. The affected CPE is microsoft:365_copilot_chat, and the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) indicates no privileges or user interaction are required, although the advisory's 'locally' qualifier and the independent assessment's UI:R reading suggest a local or user-driven context may be the real limiting factor. Exploitation status at time of analysis: no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS is 0.57% (45th percentile), so near-term exploitation is assessed as unlikely and the practical risk depends primarily on whether the vendor confirms the local-access precondition.
Command injection in Microsoft 365 Word Copilot allows an unauthenticated remote attacker to disclose information from the service, with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) indicating that no credentials, no user interaction, and only low attack complexity are needed to reach and trigger the flaw over the network, and that exploitation can affect resources beyond the vulnerable component's own security scope while the primary impact is high confidentiality loss with limited integrity impact. Because the vulnerable component is a Microsoft-operated cloud service rather than a customer-installed product, exposure is bounded by Microsoft's service-side remediation window instead of any customer-controlled configuration, and the single available MSRC advisory does not disclose the specific feature, protocol, or input channel that carries the injected command. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); EPSS is 0.57% (45th percentile), placing predicted near-term exploitation slightly below the median, so the very high base score reflects theoretical worst-case severity rather than observed attacker activity.
Improper input neutralization in Palo Alto Networks PAN-OS management web interface allows authenticated high-privilege administrators to bypass system restrictions and execute arbitrary commands through command injection. The vulnerability affects PAN-OS across multiple versions (specific version ranges not independently confirmed from provided data), with a low EPSS exploitation probability (0.06%, 17th percentile) and no confirmed active exploitation or public proof-of-concept. Risk is significantly reduced when CLI access is restricted to a limited administrator group; Cloud NGFW and Prisma Access are unaffected.
OS command injection in the Juniper Junos OS Evolved CLI allows an attacker with an existing low-privileged, local CLI session to bypass assigned permissions by supplying crafted command options that are processed through unhardened backend scripts and executed by the shell. Only Junos OS Evolved 24.2 versions before 24.2R2-S2-EVO and 24.4 versions before 24.4R2-EVO are affected, while releases earlier than 24.2R1-EVO are not affected. Exploitation requires prior authentication and local access, impact is bounded to low confidentiality, integrity, and availability effects, and no public exploit or confirmed active exploitation was identified at time of analysis; EPSS is 0.99% (61st percentile).
An OS command injection flaw in the Progress Flowmon management interface lets an authenticated administrator abuse the built-in troubleshooting scripts feature to run additional unintended commands on the underlying system. Only Flowmon deployments prior to 12.5.5 are affected, and exploitation requires network reachability to the management interface plus a valid administrator-level account, so the realistic exposure is limited to malicious insiders, compromised or stolen admin credentials, or chaining from a separate access-gaining vulnerability. There is no public exploit identified at time of analysis and no evidence of active exploitation; EPSS is low at roughly 0.38% (30th percentile), making this a high-CVSS but gated, post-authentication issue rather than a mass-exploitation priority.
Command injection in Tenda AC7 firmware 15.03.06.44 via the /goform/AdvSetLanip endpoint allows authenticated remote attackers to execute arbitrary commands with low impact on confidentiality, integrity, and availability. The vulnerability requires valid login credentials (PR:L) and affects the lanIp parameter. Publicly available exploit code exists, and EPSS scoring of 0.39% indicates low real-world exploitation probability despite public POC availability.
OS command injection in the Curo UC300 (firmware 5.42.1.7.1.63R1) unified communications device lets an authenticated attacker with admin-panel access run arbitrary operating-system commands by injecting shell metacharacters into the "IP Addr" parameter. Successful exploitation yields full command execution on the underlying device (high confidentiality, integrity, and availability impact). A public GitHub repository referenced by NVD indicates publicly available exploit code exists, though the flaw is not listed in CISA KEV and its EPSS probability is modest (1.15%, 63rd percentile).
OS command injection in DesktopCommanderMCP up to version 0.2.13 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the CommandManager function in src/command-manager.ts. The vulnerability has a low CVSS score (2.1) due to authentication requirement and limited scope, but publicly available exploit code exists and the low EPSS score (0.14th percentile) suggests real-world exploitation risk is minimal despite public POC availability.
OS command injection in DesktopCommanderMCP up to version 0.2.13 allows authenticated remote attackers to execute arbitrary operating system commands via the extractBaseCommand function in src/command-manager.ts when processing absolute file paths. The vulnerability requires authentication and has limited real-world impact scope, reflected in a low CVSS score of 2.1 and EPSS of 0.15%, though publicly available exploit code exists and the vendor acknowledges the issue remains unfixed pending real-world incident reports.
Remote command injection in D-Link DIR-852 routers allows unauthenticated attackers to execute arbitrary shell commands via the HNAP1 web interface. A public exploit is available, and the product is end-of-life with no vendor patches planned. The EPSS score of 0.34% indicates low probability of widespread exploitation, but exposed devices remain at immediate risk.
Command injection on Windows in the Deno JavaScript/TypeScript runtime (versions prior to 2.5.3 and 2.2.15) allows attacker-supplied arguments to be interpreted as shell commands when a program spawns a .bat or .cmd file as a child process. The weakness is unauthenticated from a network vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) and scores 8.1, but exploitation is conditional: it requires a Windows host, a Deno program that launches a batch file via Deno.Command or node:child_process, attacker-controlled data flowing into that process's arguments, and the 'run' permission having been granted. Publicly available exploit code exists, including a proof of concept in the GitHub security advisory that spawns calc.exe via an '&' metacharacter, and EPSS sits at 2.08% (81st percentile); there is no confirmed active exploitation (not in CISA KEV).
OS command injection in D-Link DI-7001 MINI firmware 24.04.18B1 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the path argument in /upgrade_filter.asp. Public exploit code is available, though the CVSS 2.1 score and 0.07% EPSS percentile indicate limited real-world exploitation likelihood despite the vulnerability's remote network accessibility.
Command injection in the Planet WGR-500 wireless router (firmware v1.3411b190912) allows authenticated attackers to execute arbitrary OS commands via a crafted series of HTTP requests targeting the 'counts' parameter of the formPingCmd functionality. Publicly available exploit code exists (Talos report TALOS-2025-2229), and the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability requires valid low-privileged credentials on the device's management interface, limiting its exploitability to authenticated users who can reach the web interface.
OS command injection in the formPingCmd handler of Planet WGR-500 firmware v1.3411b190912 allows an authenticated remote attacker to execute arbitrary commands on the device by sending a crafted series of HTTP requests that manipulate the `ipaddr` parameter. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires valid low-privilege credentials or an existing web UI session but no user interaction, and yields high confidentiality, integrity, and availability impact. Publicly available exploit code exists (documented in Cisco Talos advisory TALOS-2025-2229); there is currently no evidence of confirmed active exploitation (CISA KEV), and the primary risk driver is the presence of an authenticated attack surface on internet- or LAN-exposed management interfaces.
Authenticated OS command injection in the swctrl device-naming function of Planet WGR-500 firmware v1.3411b190912 allows a low-privileged user with access to the management interface to execute arbitrary commands on the underlying operating system via the `new_device_name` parameter. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is reported at time of analysis. The vulnerability requires a valid low-privilege session (CVSS PR:L) and network reachability to the device's management plane, making exposure dependent on whether the interface is internet-facing or restricted to a management VLAN.
OS command injection in the swctrl functionality of Planet WGR-500 firmware build 1.3411b190912 allows a low-privileged, network-reachable user to execute arbitrary OS commands by submitting a crafted request that embeds shell metacharacters in the `new_password` parameter, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8). Authentication is required at the low-privilege level per the CVSS vector (PR:L), so exposure is limited to users who can reach and interact with the authenticated password/configuration interface rather than fully anonymous attackers, and the flaw is scoped to this specific firmware build. Publicly available exploit code exists (publicly available exploit code exists), but there is no confirmation of active exploitation (CISA KEV) at time of analysis, and no vendor-released patch was identified in the available data.
Authenticated OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000, Ver 4.00) lets a privileged remote user inject arbitrary operating-system commands that run outside the vulnerable component, yielding full device takeover, denial of service, privilege escalation, and disclosure of sensitive timing/configuration data. Because Network Time Servers act as an authoritative time source for entire environments, compromise can cascade into time-manipulation attacks against downstream systems (logging, certificates, Kerberos). This is no public exploit identified at time of analysis, though a third-party advisory (xdiv-sec) documents the flaw; EPSS is modest at 1.63% (73rd percentile).
OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000, Ver 4.00) lets an authenticated high-privileged operator inject shell commands into the appliance's underlying OS, escaping the management application to run arbitrary code as the device. Because the appliance is a hardened timing source, successful exploitation yields full compromise: code execution, denial of service, privilege escalation, and disclosure of sensitive data. No public exploit is identified at time of analysis, though a third-party research advisory (xdiv-sec) documents the finding; the EPSS score is moderate at 1.63% (73rd percentile) and the CVE is not on CISA KEV.
OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000 Ver 4.00) lets remote attackers inject shell commands that the appliance executes, enabling arbitrary code execution, denial of service, privilege escalation, and disclosure of sensitive data. The NVD CVSS 3.1 base score is 8.2 (AV:N/AC:L/PR:N/UI:N) and a third-party technical advisory (xdiv-sec) has been published, but there is no public exploit identified at time of analysis and the flaw is not on CISA KEV. EPSS is modest at 1.20% (64th percentile), indicating no observed mass exploitation to date.
OS command injection in EndRun Technologies' Sonoma D12 GPS Network Time Server (firmware 6010-0071-000, version 4.00) lets remote attackers inject operating-system commands through the appliance's management interface, exposing sensitive information and, per the CVSS integrity rating, allowing manipulation of the device. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 8.2) indicates network-reachable, low-complexity exploitation, and an independent security-research advisory (xdiv-sec) documents the flaw. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is 1.00% (59th percentile), signaling low measured exploitation activity so far.
OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000, Ver 4.00) lets remote attackers inject operating-system commands into the appliance, enabling arbitrary code execution, privilege escalation, disclosure of sensitive data, and disruption of the device's timing service. A third-party advisory (xdiv-sec) documents the issue, but no public exploit was identified at time of analysis and it is not listed in CISA KEV; EPSS is modest at 1.20% (64th percentile). Because this device supplies authoritative time to dependent infrastructure, compromise can cascade beyond the appliance itself.
OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000 Ver 4.00) lets remote attackers inject operating-system commands and extract sensitive information from the appliance. The flaw is reachable over the network without authentication per the published CVSS vector, and a third-party security advisory (xdiv-sec) documents the issue. No public exploit identified at time of analysis, and EPSS probability is low (1.00%, 59th percentile).
Authenticated command injection in EndRun Technologies Sonoma D12 GPS Network Time Server firmware (build 6010-0071-000, Ver 4.00) lets a low-privileged user inject OS commands that run on the underlying appliance, yielding arbitrary code execution, privilege escalation, information disclosure, and denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/S:C) shows a network-reachable, low-complexity flaw whose scope change lets a foothold on the management interface compromise the whole device. A third-party advisory (xdiv-sec) documents the issue; there is no public exploit identified and no CISA KEV listing at time of analysis, and EPSS is a modest 1.58% (73rd percentile).
Command injection in D-Link DI-7100G C1 firmware up to version 20250928 allows remote authenticated attackers to execute arbitrary commands via the iface parameter in the /msp_info.htm?flag=qos endpoint of the jhttpd component. The vulnerability requires high-level administrative privileges and publicly available exploit code exists, but EPSS score of 0.06% indicates exploitation is unlikely in real-world scenarios due to the privilege requirement.
Command injection in IdeaCMS up to version 1.8 allows high-privileged remote attackers to execute arbitrary system commands via manipulation of the 网站名称 (website name) parameter in the Website Name Handler component. The vulnerability exists in app/common/logic/admin/Config.php and requires high-privilege credentials but has publicly available exploit code and carries notable risk given the vendor's non-responsiveness to early disclosure.
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands via manipulation of the command argument in the /goform/mp endpoint. The vulnerability requires valid user credentials but offers minimal impact due to restricted capabilities (low confidentiality, integrity, and availability effects). Publicly available exploit code exists, though EPSS scoring (0.20%) indicates limited real-world exploitation probability despite public availability.
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands via manipulation of the m_wan_ipaddr parameter in the /goform/formSetWanStatic endpoint. The vulnerability has publicly available exploit code and has been disclosed despite vendor non-responsiveness. With a CVSS score of 2.1 and EPSS percentile of 42%, real-world risk is low due to authentication requirement and limited impact scope, though the public POC and command injection nature warrant monitoring.
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands via manipulation of the wan_ipaddr parameter in the /goform/formBSSetSitesurvey endpoint. The vulnerability requires valid credentials and has limited scope (low confidentiality, integrity, and availability impact on the vulnerable component), but publicly available exploit code exists and the vendor has not responded to disclosure efforts.
OS command injection in MCPHub up to version 0.9.10 allows authenticated remote attackers to execute arbitrary system commands via manipulation of command/args parameters in serverController.ts. The vulnerability has a low CVSS score (2.1) due to requirement for authenticated access and limited scope impact, but carries elevated real-world risk given publicly available exploit code and vendor non-responsiveness. EPSS score of 0.25% suggests limited current exploitation activity despite POC availability.
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later
Cursor is a code editor built for programming with AI. In versions 1.7 and below, when MCP uses OAuth authentication with an untrusted MCP server, an attacker can impersonate a malicious MCP server and return crafted, maliciously injected commands during the interaction process, leading to command injection and potential remote code execution. If chained with an untrusted MCP service via OAuth, this command injection vulnerability could allow arbitrary code execution on the host by the agent. This can then be used to directly compromise the system by executing malicious commands with full user privileges. This issue does not currently have a fixed release version, but there is a patch, 2025.09.17-25b418f.
Unauthenticated OS command injection in AndSoft e-TMS v25.03 allows a remote attacker to execute arbitrary operating system commands on the application server by sending a crafted POST request to the /CLT/LOGINERRORFRM.ASP endpoint with a malicious 'm' parameter. The flaw is trivially reachable over the network - per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), no credentials or user interaction are required, and full confidentiality, integrity, and availability impact to the host is possible. Exploitation status: no public exploit identified at time of analysis, and the CVE is not in CISA KEV; EPSS is 0.25% (48th percentile), indicating low near-term exploitation likelihood, though the narrow install base of this transport-management product is the main factor constraining real-world targeting rather than any technical mitigation.
Unauthenticated remote command execution affects AndSoft e-TMS v25.03 through an OS command injection flaw in the 'm' parameter of the /clt/LOGINFRM_CAT.ASP endpoint, which processes attacker-supplied POST data without sanitization. Publicly available exploit code exists (a Gist published alongside the disclosure), meaning any internet- or network-reachable instance of the e-TMS web interface is at critical risk; however, EPSS is only 0.25% (48th percentile) and there is no CISA KEV entry confirming active exploitation. Because the assessed vectors require no authentication and no user interaction (PR:N/UI:N) while allowing high confidentiality, integrity and availability impact, successful exploitation gives an attacker the ability to run arbitrary operating system commands under the web server's privileges.
Unauthenticated OS command injection in AndSoft e-TMS v25.03 lets remote attackers run arbitrary operating system commands on the server by sending a crafted POST request to the /clt/LOGINFRM_original.ASP endpoint with a malicious value in the 'm' parameter. The CVSS 4.0 base score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H), and our independent CVSS 3.1 assessment (9.8, PR:N/UI:N) confirms no authentication or user interaction is required - exploitation only depends on the vulnerable endpoint being network-reachable. Publicly available exploit code exists (a public gist), but there is no CISA KEV listing and EPSS is modest at 0.25% (48th percentile), so the flaw is high-impact but not yet observed as mass-exploited.
OS command injection in AndSoft e-TMS v25.03 allows unauthenticated remote attackers to execute arbitrary operating system commands on the server by sending a crafted POST request to /clt/LOGINFRM_BET.ASP with attacker-controlled input in the 'm' parameter. Publicly available exploit code exists, and the CVSS 4.0 score is 9.3 with PR:N/UI:N, but EPSS is low at 0.25% (48th percentile) and there is no CISA KEV confirmation of active exploitation. This is a genuine high-severity vulnerability, though the independent assessment rates real-world priority as moderate rather than emergency because of the niche product footprint and exposure-dependent exploitation.
Unauthenticated OS command injection in AndSoft e-TMS v25.03 lets a remote attacker run arbitrary operating system commands on the server by sending a crafted POST request to the web endpoint /clt/LOGINFRM_LXA.ASP, where the 'm' parameter is passed unsanitized into a shell command. Because the vulnerable endpoint is a login form reached before authentication, no credentials or user interaction are required, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) rates it 9.3 with full compromise of the server's confidentiality, integrity and availability. Publicly available proof-of-concept exploit code exists (a GitHub gist), although EPSS is currently low at 0.25% (48th percentile) and the flaw is not listed in CISA KEV, so exploitation is not yet confirmed actively in the wild.
Unauthenticated OS command injection in AndSoft e-TMS v25.03 allows a remote attacker to execute arbitrary operating system commands on the server by sending a crafted HTTP POST request to the /clt/LOGINFRM_DJO.ASP endpoint and injecting shell metacharacters through the 'm' parameter. The flaw is rated CVSS 9.3 (v4.0) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no authentication, user interaction, or special conditions are required beyond network reachability of the application. Publicly available exploit code exists (a public gist referenced by the CVE record), but there is no CISA KEV listing, so this is not confirmed as actively exploited; EPSS is low at 0.25% (48th percentile), which combined with the version-specific exposure suggests a high-priority but likely targeted rather than mass-exploited issue.
Unauthenticated remote OS command execution in AndSoft e-TMS v25.03 is possible because the '/clt/LOGINFRM.ASP' login form accepts a crafted 'm' parameter that is passed to a server-side command without adequate neutralization. The vendor-assigned CVSS 4.0 score is 9.3, and the independent assessment vector (AV:N/AC:L/PR:N/UI:N) confirms network reachability with no authentication or user interaction required, leading to high confidentiality, integrity, and availability impact on the vulnerable server. No public exploit code or CISA KEV entry was identified in the provided data, and EPSS is 0.25% (48th percentile), indicating low current exploitation likelihood despite the severe technical impact.
Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixed in version 3.5.1.
Command injection in TOTOLINK X18 via mac parameter. EPSS 3.4%. PoC available.
Command injection in TOTOLINK X18 via agentName in setEasyMeshAgentCfg. EPSS 2.7%. PoC available.
The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Post By Email plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save_attachments function in all versions up to, and including, 1.0.4b. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system commands via a. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
VMware vCenter contains an SMTP header injection vulnerability. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME, or PASSWORD variables. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Ruijie NBR2100G-E up to 20250919. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in mirweiye wenkucms up to 3.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Tenda AC18 15.03.05.19. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in D-Link DIR-823X 250416. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in D-Link DIR-823X 250416. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in D-Link DIR-823X 250416. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in D-Link DIR-823X 250416. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in D-Link DIR-823X 250416. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in D-Link DIR-823X 250416. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in D-Link DIR-823X 250416. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in WAYOS LQ_04, LQ_05, LQ_06, LQ_07 and LQ_09 22.03.17. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in DIR-823 firmware 20250416. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Unitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass parameter (within restart_wifi_ap and restart_wifi_sta). Rated high severity (CVSS 8.2), this vulnerability is no authentication required. No vendor patch available.
An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.4.0cu.1458_B20250708. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
OS command injection in Microchip TimeProvider 4100 Grandmaster (firmware versions before 2.5) allows authenticated attackers on adjacent networks to execute arbitrary system commands with high privileges, leading to complete device compromise. The vulnerability requires low attack complexity and low privileges, with exploitation probability at 0.28% (EPSS), indicating moderate real-world risk. No public exploit identified at time of analysis, but the adjacent network requirement and low complexity make this readily exploitable in targeted attacks against time synchronization infrastructure.
OS command injection in Microchip TimeProvider 4100 Grandmaster allows authenticated adjacent network attackers to execute arbitrary system commands with elevated privileges on firmware versions prior to 2.5. The vulnerability requires low attack complexity and low privileges, enabling complete compromise of device confidentiality, integrity, and availability. EPSS exploitation probability is low (0.28%, 51st percentile) with no public exploit identified at time of analysis, though the straightforward attack vector presents significant risk to network time infrastructure in enterprise environments.
Authenticated OS command injection in Ilevia EVE X1 Server firmware versions up to and including 4.7.18.0.eden allows any user who can log in to the web management interface to execute arbitrary operating-system commands on the device. Multiple web-accessible PHP scripts pass user-supplied input directly into exec() calls without sanitization (CWE-78), so the injected commands run with the privileges of the web server process, giving full compromise of confidentiality, integrity and availability of the appliance; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network reachability, low attack complexity and a mandatory authentication prerequisite. Exploitation is conditionally gated rather than broad: EPSS is 1.99% (80th percentile), there is no CISA KEV listing, and no public exploit code has been confirmed at time of analysis even though a Zero Science Lab advisory (ZSL-2025-5966) documents the issue. The vendor has declined to remediate, so exposure depends entirely on whether TCP port 8080 is reachable from untrusted networks and on how well web-interface accounts are controlled.
Unauthenticated OS command injection in the Ilevia EVE X1 Server web interface (firmware versions up to and including 4.7.18.0.eden) allows anyone who can reach TCP port 8080 to execute arbitrary operating-system commands with the privileges of the web service, by sending crafted input to the mbus_build_from_csv.php script. The flaw is rated CVSS 4.0 9.3 (CVSS 3.1 8.8/9.8-equivalent AV:N/PR:N/UI:N with full confidentiality, integrity and availability impact), publicly available exploit code exists (Zero Science Lab ZSL-2025-5962), and EPSS is 7.62% (94th percentile) - although there is no CISA KEV confirmation of active exploitation. Ilevia has declined to service the vulnerability, so there is no vendor-released patch identified at time of analysis and exposure is governed entirely by whether port 8080 is reachable from untrusted networks.
Command injection in Zoom clients for Windows allows an authenticated user with network access to trigger a disclosure of information from a vulnerable client, affecting Zoom Workplace Desktop, the Zoom Meeting SDK, Zoom Rooms, and Zoom Workplace VDI. Exploitation requires a valid authenticated session (CVSS PR:L) but no user interaction (UI:N), and the assessed impact is confined to confidentiality (C:H) with no integrity or availability effect. There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and EPSS is 1.82% (78th percentile) - a moderate-priority issue rather than a top-tier emergency.
Command injection in F5OS-A on F5 rSeries appliances allows a highly privileged authenticated local operator to execute arbitrary system commands during FIPS HSM initialization if the initialization password contains shell metacharacters; this can cross a security boundary and cause the HSM to fail to initialize. The issue is local-only (AV:L) and requires high administrative privileges (PR:H), so it is limited to trusted insider or already-compromised admin contexts, and the independent assessment rates real-world risk LOW-to-MODERATE. EPSS is 0.18% (7th percentile), and no public exploit identified at time of analysis.
Appliance mode restrictions in F5 BIG-IP can be escaped by a highly privileged, authenticated administrator who already holds SCP and SFTP access to the device, allowing undisclosed commands to run outside the restricted shell that Appliance mode is designed to enforce. The flaw is a command-injection class issue (CWE-78) in the BIG-IP platform and affects the broad set of BIG-IP modules (APM, ASM/AWAF, AFM, Analytics, AAM, CGNAT, CIS, and others) only when the system is deliberately configured in Appliance mode - a non-default hardened lockdown state. Exploitation requires PR:H per the CVSS vector, meaning no unauthenticated or low-privileged path exists, and there is no public exploit identified at time of analysis; EPSS is low at 0.44% (37th percentile), and the CVE is not listed in CISA KEV. The net effect is a confidentiality and integrity impact (high C/I, no availability impact) for environments that tier a hardened Appliance-mode posture against trusted administrators.
Authenticated path traversal in Buffalo WXR9300BE6P series router firmware prior to Ver.1.10 lets an administrator logged into the web management interface write files to arbitrary paths, and by overwriting specific files the attacker can escalate to arbitrary OS command execution on the device. The attack is network-deliverable but gated behind a valid administrative session (CVSS PR:H), so real-world exposure is limited to insiders or attackers who already obtained admin credentials through default/weak passwords, credential reuse, CSRF, or an internet-exposed management panel. No public exploit code has been identified and the CVE is not in CISA KEV; EPSS is 0.53% (43rd percentile), making this a credible but not top-tier priority - vendor-released patch: Ver.1.10.
OS command injection in the FreePBX Endpoint Manager module's Network Scanning feature allows a highly privileged, authenticated user to execute arbitrary operating system commands as the asterisk service account, affecting Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6. The CVSS 4.0 base score is 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L), and our independent assessment concurs with high confidentiality and integrity impact but only low availability impact, since this is effectively post-authentication command execution rather than a pre-auth compromise. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS is low at 0.53% (43rd percentile), so the practical risk is concentrated in deployments where the Endpoint Manager commercial module is installed and its Network Scanning feature is reachable. Vendor-released patches exist: Endpoint Manager 16.0.92 and 17.0.6.
Authenticated remote code execution in FlowiseAI Flowise (v3.0.1 up to but not including 3.0.8, and later versions when 'ALLOW_BUILTIN_DEP' is enabled) lets a logged-in user break out of the nodevm sandbox by abusing the bundled Puppeteer and Playwright modules. Because a custom tool can specify an attacker-controlled browser binary path and launch parameters, executing that tool runs an arbitrary executable on the host outside the intended sandbox, yielding code execution in the host context. Publicly available exploit code exists; the flaw is not listed in CISA KEV, and it was mis-filed by the vendor as a duplicate of CVE-2025-26319 but is distinct.
Authenticated command injection in the web-based management interface of HPE network access point configuration services allows a remote attacker holding high-level administrative privileges to execute arbitrary commands on the access point's underlying operating system, resulting in full compromise of confidentiality, integrity, and availability of the device (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The PR:H requirement is the dominant limiting factor: exploitation is only possible after successful authentication to the management plane with administrative rights, so default-configuration devices are not reachable by unauthenticated users. EPSS is low at 0.89% (58th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis; the practical risk is therefore bounded by how tightly administrative access to the management interface is restricted.
Authenticated command injection in the command-line interface binary of HPE Aruba Networking AOS-10 Gateways and AOS-8 Controllers/Mobility Conductors lets an attacker who already holds high-privilege CLI credentials and has physical access to the appliance hardware escape the restricted CLI and execute arbitrary commands as a privileged user on the underlying operating system. The flaw carries a CVSS v3.1 score of 6.2 (CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so although confidentiality, integrity and availability impact is rated High, the vector is gated by two strong preconditions - physical access to the controller hardware (AV:P) and high-privilege authenticated access to the CLI (PR:H) - keeping real-world risk low. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is only 0.66% (50th percentile), consistent with a vulnerability that cannot be reached remotely.
Authenticated command injection in the ArubaOS (AOS-8) Controller and Mobility Conductor CLI allows a privileged administrator to execute arbitrary commands as a privileged user on the underlying operating system, achieving high confidentiality, integrity, and availability impact (CVSS 7.2). Exploitation requires valid privileged credentials (PR:H) and network reachability to the management CLI, and no public exploit has been identified; EPSS is 1.23% (68th percentile), indicating a moderate, non-emergency risk. The vendor has published an advisory (HPE docDisplay hpesbnw04957en_us) that should be consulted for fixed versions.
Authenticated command injection in the ArubaOS (AOS-8) Controller and Mobility Conductor CLI lets an attacker who already holds a privileged administrator-level CLI account execute arbitrary commands as a privileged user on the underlying operating system. The weakness is limited by its PR:H prerequisite - a valid high-privilege, network-reachable CLI session is required - so realistic exposure is confined to compromised admin credentials, reused/leaked administrator logins, or malicious insiders rather than unauthenticated outsiders. At time of analysis there is no CISA KEV listing and no public exploit code identified; EPSS sits at 1.23% (68th percentile), consistent with a genuine but moderate-priority issue rather than an emergency, and defenders should confirm the exact affected AOS-8 release trains against the HPE advisory because the CPE entries carry unversioned wildcards.
Authenticated attackers holding administrator privileges on Ivanti EPMM can inject OS commands through the admin panel and execute arbitrary code on the underlying server in versions prior to 12.6.0.2, 12.5.0.4, and 12.4.0.4. The flaw carries a CVSS base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and an EPSS probability of 20.35% (97th percentile), indicating elevated likelihood of exploitation activity, although no public exploit code or CISA KEV listing was identified at time of analysis. Because the prerequisite is an already-compromised administrative session, practical risk escalates where admin interfaces are reachable from untrusted networks or where credentials are reused.
Authenticated OS command injection in Ivanti Endpoint Manager Mobile (EPMM) allows a remote attacker with admin privileges to execute arbitrary OS commands and achieve remote code execution on versions before 12.6.0.2, 12.5.0.4, and 12.4.0.4. Exploitation requires a valid admin session (CVSS PR:H), and no public exploit has been identified at time of analysis; however, the EPSS score is 20.35% (97th percentile), indicating elevated risk. The impact is high, with potential for full compromise of the EPMM server.
OS command injection in the administrative panel of Ivanti Endpoint Manager Mobile (EPMM) enables remote code execution for an attacker who already possesses an authenticated admin session. The flaw affects versions prior to 12.6.0.2, 12.5.0.4, and 12.4.0.4; the CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N) because the high privilege prerequisite limits the attack surface. Despite the moderate base score, the EPSS score of 20.35% (97th percentile) indicates an unusually high exploitation probability, though no public exploit code or confirmed active exploitation was identified at time of analysis.
OS command injection in Fortinet FortiVoice allows an authenticated administrator to execute arbitrary operating-system commands on the appliance by sending crafted HTTP/HTTPS requests to the management interface or crafted CLI commands. Affected deployments are FortiVoice 7.2.0, 7.0.0 through 7.0.6, and versions before 6.4.10, and because the CVSS vector carries PR:H, the attacker must already hold privileged (administrative) access, making this a post-authentication issue rather than an unauthenticated remote compromise. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is modest at 1.32% (70th percentile), so this is a genuine but second-tier priority rather than an emergency, with the strongest risk driver being exposed or shared administrative credentials on the FortiVoice management interface.
OS command injection in the 3DEXPERIENCE Station Launcher App (releases R2022x through R2025x) allows an attacker to execute arbitrary code on the user's machine by supplying crafted input that the launcher processes, such as a malicious link or file. Exploitation requires the victim to run the affected launcher and interact with the attacker-controlled input (UI:R), with code executing locally under the user's privileges. The vendor CVSS vector indicates an authenticated context (PR:L), while the independent assessment scores it as unauthenticated (PR:N); no public exploit code or active exploitation has been identified at time of analysis.
OS command injection in the firmware update handler of the end-of-life D-Link DAP-2695 wireless access point (build 2.00RC131) allows remote attackers with administrative credentials to execute arbitrary OS commands on the device through the fwupdater_main routine in rgbin. Exploitation requires authenticated administrative access to the management interface (PR:H per the assessed vector), and because the product is no longer supported by D-Link, no vendor patch will be issued - mitigation depends entirely on restricting who can reach the admin interface. Publicly available exploit code exists (a technical write-up with PoC details is hosted on GitHub), and the EPSS score of 6.81% (94th percentile) indicates elevated relative attention despite the authentication prerequisite and limited, low-severity impact (C:L/I:L/A:L).
Improper input validation (CWE-20) in HCL Unica MaxAI Workbench, the AI component within HCL's Unica marketing suite, lets an authenticated low-privileged user plant crafted input in a field that is later rendered to a second user, resulting in reflected cross-site scripting rather than the server-side SQL injection or command injection implied by the vendor's generic description. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, base 3.5) limits the demonstrated impact to partial integrity loss with no confidentiality or availability effect, and exploitation requires both a valid low-privileged account and victim user interaction. Risk is low: EPSS is 0.50 percent (40th percentile), no publicly available exploit code and no CISA KEV entry were identified at time of analysis, and the breadth of the advisory text is not supported by the scored vector.
Arbitrary file upload in Mingsoft MCMS v6.0.1 enables remote code execution on the underlying server by uploading a crafted file - likely a JSP web shell - to a reachable endpoint. The NVD-assigned CVSS score of 6.5 with C:L/I:L impact subscores is materially inconsistent with the stated code execution impact, and this discrepancy should be independently verified. No public exploit has been confirmed as actively exploited per CISA KEV, though a Gist-based reference in NVD data may represent a proof-of-concept; EPSS is low at 0.28% (20th percentile), suggesting no widespread scanning or exploitation observed at time of analysis.
Crafted command input submitted to Microsoft 365 Copilot Chat can cause the hardened service to disclose sensitive information across a trust boundary, because the service fails to neutralize special command elements before interpreting user-supplied content (CWE-77). The flaw is reachable over the network with no authentication, no privileges, and no user interaction (CVSS 9.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), so any organization whose users rely on the hosted Copilot Chat service is exposed. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and EPSS is low at 0.57% (45th percentile); because this is a Microsoft-operated cloud service, the exposure window closes for all tenants once Microsoft completes server-side remediation.
Improper neutralization of special elements (CWE-77 command injection) in Microsoft 365 Copilot Chat allows an unauthenticated attacker to trigger information disclosure that crosses a scope boundary, yielding a CVSS 3.1 base score of 9.3 (Critical) with high confidentiality impact and low integrity impact. The affected CPE is microsoft:365_copilot_chat, and the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) indicates no privileges or user interaction are required, although the advisory's 'locally' qualifier and the independent assessment's UI:R reading suggest a local or user-driven context may be the real limiting factor. Exploitation status at time of analysis: no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS is 0.57% (45th percentile), so near-term exploitation is assessed as unlikely and the practical risk depends primarily on whether the vendor confirms the local-access precondition.
Command injection in Microsoft 365 Word Copilot allows an unauthenticated remote attacker to disclose information from the service, with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) indicating that no credentials, no user interaction, and only low attack complexity are needed to reach and trigger the flaw over the network, and that exploitation can affect resources beyond the vulnerable component's own security scope while the primary impact is high confidentiality loss with limited integrity impact. Because the vulnerable component is a Microsoft-operated cloud service rather than a customer-installed product, exposure is bounded by Microsoft's service-side remediation window instead of any customer-controlled configuration, and the single available MSRC advisory does not disclose the specific feature, protocol, or input channel that carries the injected command. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); EPSS is 0.57% (45th percentile), placing predicted near-term exploitation slightly below the median, so the very high base score reflects theoretical worst-case severity rather than observed attacker activity.
Improper input neutralization in Palo Alto Networks PAN-OS management web interface allows authenticated high-privilege administrators to bypass system restrictions and execute arbitrary commands through command injection. The vulnerability affects PAN-OS across multiple versions (specific version ranges not independently confirmed from provided data), with a low EPSS exploitation probability (0.06%, 17th percentile) and no confirmed active exploitation or public proof-of-concept. Risk is significantly reduced when CLI access is restricted to a limited administrator group; Cloud NGFW and Prisma Access are unaffected.
OS command injection in the Juniper Junos OS Evolved CLI allows an attacker with an existing low-privileged, local CLI session to bypass assigned permissions by supplying crafted command options that are processed through unhardened backend scripts and executed by the shell. Only Junos OS Evolved 24.2 versions before 24.2R2-S2-EVO and 24.4 versions before 24.4R2-EVO are affected, while releases earlier than 24.2R1-EVO are not affected. Exploitation requires prior authentication and local access, impact is bounded to low confidentiality, integrity, and availability effects, and no public exploit or confirmed active exploitation was identified at time of analysis; EPSS is 0.99% (61st percentile).
An OS command injection flaw in the Progress Flowmon management interface lets an authenticated administrator abuse the built-in troubleshooting scripts feature to run additional unintended commands on the underlying system. Only Flowmon deployments prior to 12.5.5 are affected, and exploitation requires network reachability to the management interface plus a valid administrator-level account, so the realistic exposure is limited to malicious insiders, compromised or stolen admin credentials, or chaining from a separate access-gaining vulnerability. There is no public exploit identified at time of analysis and no evidence of active exploitation; EPSS is low at roughly 0.38% (30th percentile), making this a high-CVSS but gated, post-authentication issue rather than a mass-exploitation priority.
Command injection in Tenda AC7 firmware 15.03.06.44 via the /goform/AdvSetLanip endpoint allows authenticated remote attackers to execute arbitrary commands with low impact on confidentiality, integrity, and availability. The vulnerability requires valid login credentials (PR:L) and affects the lanIp parameter. Publicly available exploit code exists, and EPSS scoring of 0.39% indicates low real-world exploitation probability despite public POC availability.
OS command injection in the Curo UC300 (firmware 5.42.1.7.1.63R1) unified communications device lets an authenticated attacker with admin-panel access run arbitrary operating-system commands by injecting shell metacharacters into the "IP Addr" parameter. Successful exploitation yields full command execution on the underlying device (high confidentiality, integrity, and availability impact). A public GitHub repository referenced by NVD indicates publicly available exploit code exists, though the flaw is not listed in CISA KEV and its EPSS probability is modest (1.15%, 63rd percentile).
OS command injection in DesktopCommanderMCP up to version 0.2.13 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the CommandManager function in src/command-manager.ts. The vulnerability has a low CVSS score (2.1) due to authentication requirement and limited scope, but publicly available exploit code exists and the low EPSS score (0.14th percentile) suggests real-world exploitation risk is minimal despite public POC availability.
OS command injection in DesktopCommanderMCP up to version 0.2.13 allows authenticated remote attackers to execute arbitrary operating system commands via the extractBaseCommand function in src/command-manager.ts when processing absolute file paths. The vulnerability requires authentication and has limited real-world impact scope, reflected in a low CVSS score of 2.1 and EPSS of 0.15%, though publicly available exploit code exists and the vendor acknowledges the issue remains unfixed pending real-world incident reports.
Remote command injection in D-Link DIR-852 routers allows unauthenticated attackers to execute arbitrary shell commands via the HNAP1 web interface. A public exploit is available, and the product is end-of-life with no vendor patches planned. The EPSS score of 0.34% indicates low probability of widespread exploitation, but exposed devices remain at immediate risk.
Command injection on Windows in the Deno JavaScript/TypeScript runtime (versions prior to 2.5.3 and 2.2.15) allows attacker-supplied arguments to be interpreted as shell commands when a program spawns a .bat or .cmd file as a child process. The weakness is unauthenticated from a network vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) and scores 8.1, but exploitation is conditional: it requires a Windows host, a Deno program that launches a batch file via Deno.Command or node:child_process, attacker-controlled data flowing into that process's arguments, and the 'run' permission having been granted. Publicly available exploit code exists, including a proof of concept in the GitHub security advisory that spawns calc.exe via an '&' metacharacter, and EPSS sits at 2.08% (81st percentile); there is no confirmed active exploitation (not in CISA KEV).
OS command injection in D-Link DI-7001 MINI firmware 24.04.18B1 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the path argument in /upgrade_filter.asp. Public exploit code is available, though the CVSS 2.1 score and 0.07% EPSS percentile indicate limited real-world exploitation likelihood despite the vulnerability's remote network accessibility.
Command injection in the Planet WGR-500 wireless router (firmware v1.3411b190912) allows authenticated attackers to execute arbitrary OS commands via a crafted series of HTTP requests targeting the 'counts' parameter of the formPingCmd functionality. Publicly available exploit code exists (Talos report TALOS-2025-2229), and the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability requires valid low-privileged credentials on the device's management interface, limiting its exploitability to authenticated users who can reach the web interface.
OS command injection in the formPingCmd handler of Planet WGR-500 firmware v1.3411b190912 allows an authenticated remote attacker to execute arbitrary commands on the device by sending a crafted series of HTTP requests that manipulate the `ipaddr` parameter. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires valid low-privilege credentials or an existing web UI session but no user interaction, and yields high confidentiality, integrity, and availability impact. Publicly available exploit code exists (documented in Cisco Talos advisory TALOS-2025-2229); there is currently no evidence of confirmed active exploitation (CISA KEV), and the primary risk driver is the presence of an authenticated attack surface on internet- or LAN-exposed management interfaces.
Authenticated OS command injection in the swctrl device-naming function of Planet WGR-500 firmware v1.3411b190912 allows a low-privileged user with access to the management interface to execute arbitrary commands on the underlying operating system via the `new_device_name` parameter. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is reported at time of analysis. The vulnerability requires a valid low-privilege session (CVSS PR:L) and network reachability to the device's management plane, making exposure dependent on whether the interface is internet-facing or restricted to a management VLAN.
OS command injection in the swctrl functionality of Planet WGR-500 firmware build 1.3411b190912 allows a low-privileged, network-reachable user to execute arbitrary OS commands by submitting a crafted request that embeds shell metacharacters in the `new_password` parameter, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8). Authentication is required at the low-privilege level per the CVSS vector (PR:L), so exposure is limited to users who can reach and interact with the authenticated password/configuration interface rather than fully anonymous attackers, and the flaw is scoped to this specific firmware build. Publicly available exploit code exists (publicly available exploit code exists), but there is no confirmation of active exploitation (CISA KEV) at time of analysis, and no vendor-released patch was identified in the available data.
Authenticated OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000, Ver 4.00) lets a privileged remote user inject arbitrary operating-system commands that run outside the vulnerable component, yielding full device takeover, denial of service, privilege escalation, and disclosure of sensitive timing/configuration data. Because Network Time Servers act as an authoritative time source for entire environments, compromise can cascade into time-manipulation attacks against downstream systems (logging, certificates, Kerberos). This is no public exploit identified at time of analysis, though a third-party advisory (xdiv-sec) documents the flaw; EPSS is modest at 1.63% (73rd percentile).
OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000, Ver 4.00) lets an authenticated high-privileged operator inject shell commands into the appliance's underlying OS, escaping the management application to run arbitrary code as the device. Because the appliance is a hardened timing source, successful exploitation yields full compromise: code execution, denial of service, privilege escalation, and disclosure of sensitive data. No public exploit is identified at time of analysis, though a third-party research advisory (xdiv-sec) documents the finding; the EPSS score is moderate at 1.63% (73rd percentile) and the CVE is not on CISA KEV.
OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000 Ver 4.00) lets remote attackers inject shell commands that the appliance executes, enabling arbitrary code execution, denial of service, privilege escalation, and disclosure of sensitive data. The NVD CVSS 3.1 base score is 8.2 (AV:N/AC:L/PR:N/UI:N) and a third-party technical advisory (xdiv-sec) has been published, but there is no public exploit identified at time of analysis and the flaw is not on CISA KEV. EPSS is modest at 1.20% (64th percentile), indicating no observed mass exploitation to date.
OS command injection in EndRun Technologies' Sonoma D12 GPS Network Time Server (firmware 6010-0071-000, version 4.00) lets remote attackers inject operating-system commands through the appliance's management interface, exposing sensitive information and, per the CVSS integrity rating, allowing manipulation of the device. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 8.2) indicates network-reachable, low-complexity exploitation, and an independent security-research advisory (xdiv-sec) documents the flaw. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is 1.00% (59th percentile), signaling low measured exploitation activity so far.
OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000, Ver 4.00) lets remote attackers inject operating-system commands into the appliance, enabling arbitrary code execution, privilege escalation, disclosure of sensitive data, and disruption of the device's timing service. A third-party advisory (xdiv-sec) documents the issue, but no public exploit was identified at time of analysis and it is not listed in CISA KEV; EPSS is modest at 1.20% (64th percentile). Because this device supplies authoritative time to dependent infrastructure, compromise can cascade beyond the appliance itself.
OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000 Ver 4.00) lets remote attackers inject operating-system commands and extract sensitive information from the appliance. The flaw is reachable over the network without authentication per the published CVSS vector, and a third-party security advisory (xdiv-sec) documents the issue. No public exploit identified at time of analysis, and EPSS probability is low (1.00%, 59th percentile).
Authenticated command injection in EndRun Technologies Sonoma D12 GPS Network Time Server firmware (build 6010-0071-000, Ver 4.00) lets a low-privileged user inject OS commands that run on the underlying appliance, yielding arbitrary code execution, privilege escalation, information disclosure, and denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/S:C) shows a network-reachable, low-complexity flaw whose scope change lets a foothold on the management interface compromise the whole device. A third-party advisory (xdiv-sec) documents the issue; there is no public exploit identified and no CISA KEV listing at time of analysis, and EPSS is a modest 1.58% (73rd percentile).
Command injection in D-Link DI-7100G C1 firmware up to version 20250928 allows remote authenticated attackers to execute arbitrary commands via the iface parameter in the /msp_info.htm?flag=qos endpoint of the jhttpd component. The vulnerability requires high-level administrative privileges and publicly available exploit code exists, but EPSS score of 0.06% indicates exploitation is unlikely in real-world scenarios due to the privilege requirement.
Command injection in IdeaCMS up to version 1.8 allows high-privileged remote attackers to execute arbitrary system commands via manipulation of the 网站名称 (website name) parameter in the Website Name Handler component. The vulnerability exists in app/common/logic/admin/Config.php and requires high-privilege credentials but has publicly available exploit code and carries notable risk given the vendor's non-responsiveness to early disclosure.
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands via manipulation of the command argument in the /goform/mp endpoint. The vulnerability requires valid user credentials but offers minimal impact due to restricted capabilities (low confidentiality, integrity, and availability effects). Publicly available exploit code exists, though EPSS scoring (0.20%) indicates limited real-world exploitation probability despite public availability.
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands via manipulation of the m_wan_ipaddr parameter in the /goform/formSetWanStatic endpoint. The vulnerability has publicly available exploit code and has been disclosed despite vendor non-responsiveness. With a CVSS score of 2.1 and EPSS percentile of 42%, real-world risk is low due to authentication requirement and limited impact scope, though the public POC and command injection nature warrant monitoring.
Command injection in Belkin F9K1015 firmware 1.00.10 allows authenticated remote attackers to execute arbitrary commands via manipulation of the wan_ipaddr parameter in the /goform/formBSSetSitesurvey endpoint. The vulnerability requires valid credentials and has limited scope (low confidentiality, integrity, and availability impact on the vulnerable component), but publicly available exploit code exists and the vendor has not responded to disclosure efforts.
OS command injection in MCPHub up to version 0.9.10 allows authenticated remote attackers to execute arbitrary system commands via manipulation of command/args parameters in serverController.ts. The vulnerability has a low CVSS score (2.1) due to requirement for authenticated access and limited scope impact, but carries elevated real-world risk given publicly available exploit code and vendor non-responsiveness. EPSS score of 0.25% suggests limited current exploitation activity despite POC availability.
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later
Cursor is a code editor built for programming with AI. In versions 1.7 and below, when MCP uses OAuth authentication with an untrusted MCP server, an attacker can impersonate a malicious MCP server and return crafted, maliciously injected commands during the interaction process, leading to command injection and potential remote code execution. If chained with an untrusted MCP service via OAuth, this command injection vulnerability could allow arbitrary code execution on the host by the agent. This can then be used to directly compromise the system by executing malicious commands with full user privileges. This issue does not currently have a fixed release version, but there is a patch, 2025.09.17-25b418f.
Unauthenticated OS command injection in AndSoft e-TMS v25.03 allows a remote attacker to execute arbitrary operating system commands on the application server by sending a crafted POST request to the /CLT/LOGINERRORFRM.ASP endpoint with a malicious 'm' parameter. The flaw is trivially reachable over the network - per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), no credentials or user interaction are required, and full confidentiality, integrity, and availability impact to the host is possible. Exploitation status: no public exploit identified at time of analysis, and the CVE is not in CISA KEV; EPSS is 0.25% (48th percentile), indicating low near-term exploitation likelihood, though the narrow install base of this transport-management product is the main factor constraining real-world targeting rather than any technical mitigation.
Unauthenticated remote command execution affects AndSoft e-TMS v25.03 through an OS command injection flaw in the 'm' parameter of the /clt/LOGINFRM_CAT.ASP endpoint, which processes attacker-supplied POST data without sanitization. Publicly available exploit code exists (a Gist published alongside the disclosure), meaning any internet- or network-reachable instance of the e-TMS web interface is at critical risk; however, EPSS is only 0.25% (48th percentile) and there is no CISA KEV entry confirming active exploitation. Because the assessed vectors require no authentication and no user interaction (PR:N/UI:N) while allowing high confidentiality, integrity and availability impact, successful exploitation gives an attacker the ability to run arbitrary operating system commands under the web server's privileges.
Unauthenticated OS command injection in AndSoft e-TMS v25.03 lets remote attackers run arbitrary operating system commands on the server by sending a crafted POST request to the /clt/LOGINFRM_original.ASP endpoint with a malicious value in the 'm' parameter. The CVSS 4.0 base score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H), and our independent CVSS 3.1 assessment (9.8, PR:N/UI:N) confirms no authentication or user interaction is required - exploitation only depends on the vulnerable endpoint being network-reachable. Publicly available exploit code exists (a public gist), but there is no CISA KEV listing and EPSS is modest at 0.25% (48th percentile), so the flaw is high-impact but not yet observed as mass-exploited.
OS command injection in AndSoft e-TMS v25.03 allows unauthenticated remote attackers to execute arbitrary operating system commands on the server by sending a crafted POST request to /clt/LOGINFRM_BET.ASP with attacker-controlled input in the 'm' parameter. Publicly available exploit code exists, and the CVSS 4.0 score is 9.3 with PR:N/UI:N, but EPSS is low at 0.25% (48th percentile) and there is no CISA KEV confirmation of active exploitation. This is a genuine high-severity vulnerability, though the independent assessment rates real-world priority as moderate rather than emergency because of the niche product footprint and exposure-dependent exploitation.
Unauthenticated OS command injection in AndSoft e-TMS v25.03 lets a remote attacker run arbitrary operating system commands on the server by sending a crafted POST request to the web endpoint /clt/LOGINFRM_LXA.ASP, where the 'm' parameter is passed unsanitized into a shell command. Because the vulnerable endpoint is a login form reached before authentication, no credentials or user interaction are required, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) rates it 9.3 with full compromise of the server's confidentiality, integrity and availability. Publicly available proof-of-concept exploit code exists (a GitHub gist), although EPSS is currently low at 0.25% (48th percentile) and the flaw is not listed in CISA KEV, so exploitation is not yet confirmed actively in the wild.
Unauthenticated OS command injection in AndSoft e-TMS v25.03 allows a remote attacker to execute arbitrary operating system commands on the server by sending a crafted HTTP POST request to the /clt/LOGINFRM_DJO.ASP endpoint and injecting shell metacharacters through the 'm' parameter. The flaw is rated CVSS 9.3 (v4.0) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no authentication, user interaction, or special conditions are required beyond network reachability of the application. Publicly available exploit code exists (a public gist referenced by the CVE record), but there is no CISA KEV listing, so this is not confirmed as actively exploited; EPSS is low at 0.25% (48th percentile), which combined with the version-specific exposure suggests a high-priority but likely targeted rather than mass-exploited issue.
Unauthenticated remote OS command execution in AndSoft e-TMS v25.03 is possible because the '/clt/LOGINFRM.ASP' login form accepts a crafted 'm' parameter that is passed to a server-side command without adequate neutralization. The vendor-assigned CVSS 4.0 score is 9.3, and the independent assessment vector (AV:N/AC:L/PR:N/UI:N) confirms network reachability with no authentication or user interaction required, leading to high confidentiality, integrity, and availability impact on the vulnerable server. No public exploit code or CISA KEV entry was identified in the provided data, and EPSS is 0.25% (48th percentile), indicating low current exploitation likelihood despite the severe technical impact.
Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixed in version 3.5.1.
Command injection in TOTOLINK X18 via mac parameter. EPSS 3.4%. PoC available.
Command injection in TOTOLINK X18 via agentName in setEasyMeshAgentCfg. EPSS 2.7%. PoC available.
The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Post By Email plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save_attachments function in all versions up to, and including, 1.0.4b. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remote attackers to execute arbitrary system commands via a. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
VMware vCenter contains an SMTP header injection vulnerability. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME, or PASSWORD variables. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Ruijie NBR2100G-E up to 20250919. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in mirweiye wenkucms up to 3.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Tenda AC18 15.03.05.19. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in D-Link DIR-823X 250416. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in D-Link DIR-823X 250416. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in D-Link DIR-823X 250416. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in D-Link DIR-823X 250416. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in D-Link DIR-823X 250416. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in D-Link DIR-823X 250416. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in D-Link DIR-823X 250416. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in WAYOS LQ_04, LQ_05, LQ_06, LQ_07 and LQ_09 22.03.17. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in DIR-823 firmware 20250416. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple robotic products by Unitree sharing a common firmware, including the Go2, G1, H1, and B2 devices, contain a command injection vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Unitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass parameter (within restart_wifi_ap and restart_wifi_sta). Rated high severity (CVSS 8.2), this vulnerability is no authentication required. No vendor patch available.
An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.4.0cu.1458_B20250708. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.