OS Command Injection

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax test functionality implemented by. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Command injection in the ArubaOS command line interface allows an authenticated remote attacker with low-privileged credentials to execute arbitrary commands on the underlying operating system, yielding full compromise of confidentiality, integrity, and availability on the affected device. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires both network reachability to the management CLI and a valid low-privilege account - an unauthenticated attacker cannot exploit it. At time of analysis, no public exploit identified and EPSS is low at 0.10% (28th percentile), with no CISA KEV listing, so this is a credible operational priority for organizations running Aruba/HPE wireless infrastructure rather than an emergency.

pnetlab 5.3.11 is vulnerable to Command Injection via the qemu_options parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A command injection vulnerability exists in the AOS-CX Operating System. Rated medium severity (CVSS 6.7), this vulnerability is no authentication required. No vendor patch available.

A command injection vulnerability exists in the AOS-CX Operating System. Rated medium severity (CVSS 6.7), this vulnerability is no authentication required. No vendor patch available.

A remote command execution (RCE) vulnerability was discovered in all H3C ERG3/ERG5 series routers and XiaoBei series routers, cloud gateways, and wireless access points (versions R0162P07,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthenticated attacker to perform DoS attacks. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the execute_query method. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A command injection vulnerability exists in the MCP Data Science Server's (reading-plus-ai/mcp-server-data-exploration) 0.1.6 in the safe_eval() function (src/mcp_server_ds/server.py:108). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an authenticated attacker to execute. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Glob matches files using patterns the shell uses. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Public exploit code available.

OS command injection in Maxum Rumpus 9.0.12 allows remote attackers to execute arbitrary operating system commands on the underlying macOS host, carrying a vendor-assessed CVSS 3.1 score of 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) that implies full loss of confidentiality, integrity, and availability. The vector indicates the attack is network-reachable with no authentication and no user interaction, although that unauthenticated characterization derives solely from the PR:N metric and is not corroborated by any description text, so it should be treated as vendor-supplied rather than independently verified. No public exploit identified at time of analysis, EPSS is low at 0.14% (33rd percentile), and there is no KEV listing, so the practical risk is concentrated on internet-facing or otherwise network-reachable Rumpus instances - typically a small number of macOS file-transfer hosts - rather than widespread opportunistic exploitation.

Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to leak. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

TG8 Firewall contains a pre-authentication remote code execution vulnerability in the runphpcmd.php endpoint. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

IPCop versions up to and including 2.1.9 contain an authenticated remote code execution vulnerability within the web-based administration interface. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in the FunctionField.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /tmp/new_qos.rule. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `librcm.so` binaries. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /var/system/linux_vlan_reinit. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Command injection in the REST API of Cisco Catalyst Center allows an authenticated remote attacker with at least Observer privileges to execute arbitrary commands as root within a restricted container. The vulnerability arises from insufficient validation of user-supplied input in REST API request parameters and carries a CVSS score of 8.8. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.35% indicates a low probability of exploitation; the requirement for valid credentials-even low-privileged Observer accounts-is the primary limiting factor.

An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). Rated medium severity (CVSS 5.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41EC68 function). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary, specifically in the sub_40BFA4 function that handles network interface. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 10.3%.

A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the cloudupdate_check binary, specifically in the sub_402414 function that handles cloud. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Command injection in pgAdmin 4 versions up to 9.9 on Windows allows an attacker who can supply a crafted file path to the backup or restore workflow to execute arbitrary operating-system commands with the privileges of the pgAdmin process. The flaw stems from Python's shell=True being passed to the backup/restore command construction, so shell metacharacters embedded in the path are interpreted rather than treated as literal text. Exposure is limited: the defect does not affect Linux or macOS hosts, and triggering it requires reaching pgAdmin's backup/restore feature (typically an authenticated session in server mode, or a local desktop user who opens a malicious path), which our assessment captures as PR:L with a user-driven step. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.08% (24th percentile), and a vendor patch is available, so the practical risk is real but not urgent.

Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally. Rated medium severity (CVSS 6.7). No vendor patch available.

An issue in Agnitum Outpost Security Suite 7.5.3 (3942.608.1810) and 7.6 (3984.693.1842) allows a local attacker to execute arbitrary code via the lock function. Rated high severity (CVSS 7.7), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.

Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.

KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: during startup /usr/sbin/anyka_service.sh scans mounted TF/SD. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A Command Injection vulnerability, resulting from improper file path sanitization (Directory Traversal) in Looker allows an attacker with Developer permission to execute arbitrary shell commands when. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2,. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability within the web management interface that allows for unauthenticated attackers to. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 13.2% and no vendor patch available.

PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to cause Command Injection on an affected Dell CloudLink. Rated medium severity (CVSS 5.3). No vendor patch available.

Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell access of system. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.

Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain control of system. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.

OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A flaw was found in Red Hat Satellite (Foreman component). Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable. No vendor patch available.

Cursor is a code editor built for programming with AI. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Cursor is a code editor built for programming with AI. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom_node_normalize function. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Command injection in the Nagios XI Core Config Manager (CCM) Run Check feature lets an authenticated administrator inject shell metacharacters into parameters that are handed to a backend command line, resulting in arbitrary command execution as the Nagios XI web application user and, from there, compromise of the underlying host. Every Nagios XI release prior to 2026R1 is affected; the CVSS v4.0 score is 9.4 (vector AV:N/AC:L/AT:N/PR:H/UI:N with high integrity, confidentiality and availability impact and scope change), and our independent assessment aligns at CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The practical barrier is privilege, not reachability: exploitation requires a valid Nagios XI administrator account with access to CCM, so this is a post-authentication foothold and privilege-escalation path rather than an unauthenticated internet-facing flaw; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the vendor has shipped a fixed release, 2026R1.

Command injection in Nagios XI's WinRM plugin allows an authenticated administrator to convert crafted plugin parameters into arbitrary OS commands executed as the Nagios XI web application user. Affected releases are Nagios XI prior to 2024R2, including 2024 R1 and its R1.x updates; the vendor changelog and security page list 2024R2 as the remediating release. No public exploit code or CISA KEV entry was identified at time of analysis, but the CVSS 4.0 base score is 9.4 because exploitation can fully compromise the Nagios host and related monitoring data.

Command injection in the LDAP certificate removal function of Nagios Network Analyzer lets an authenticated administrator (CVSS PR:H) execute arbitrary operating-system commands on the underlying host, running with the privileges of the web application service account rather than root. The flaw is rated CVSS 4.0 8.6 (High) and affects Nagios Network Analyzer versions prior to 2024R2.0.1, including the 2024 R1.0.1, R1.0.2, R1.0.3 and 2024 R2 releases; it is a post-authentication issue, so successful exploitation requires valid administrator-level credentials and a deployment in which LDAP authentication/certificate features are actually configured. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the practical risk is bounded by the mandatory high-privilege prerequisite and the service-account context of the resulting code execution.

Nagios XI instances running versions prior to 2024R1.4.2 are exposed to a high-severity remote code execution vulnerability in the Business Process Intelligence (BPI) component, where an authenticated administrative user can exploit insufficient validation of the bpi_logfile and bpi_configfile parameters to create or overwrite executable files in the webroot and then execute them as the web application user. The flaw requires administrative privileges (PR:H) and is not exploitable by anonymous or low-privileged remote attackers; no public exploit code has been identified at time of analysis, and the CVSS 4.0 score is 9.4 with a 3.1 assessment of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Successful exploitation yields arbitrary command execution with web application user privileges, potentially leading to full host compromise, but the administrative gating condition tempers real-world urgency compared to unauthenticated RCE flaws.

OS command injection in Dell Unity, UnityVSA, and Unity XT operating environment version 5.5 and prior allows a low-privileged, locally authenticated attacker to execute arbitrary OS commands with root privileges, escalating from an ordinary operator account to full control of the storage array. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a pre-existing local session on the system and no interaction from another user. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS is 0.51% (41st percentile), indicating low near-term exploitation probability, though the impact of successful privilege escalation on a storage platform is high.

Command injection in Dell Unity Operating Environment (OE) 5.5 and prior lets an authenticated low-privileged attacker with local access execute arbitrary OS commands as root on the storage appliance, affecting Dell Unity, Unity XT, and the UnityVSA virtual edition. The flaw is rated CVSS v3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning a successful exploit yields complete compromise of confidentiality, integrity, and availability once the attacker has a foothold on the array. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable); EPSS is low at roughly 0.5% (41st percentile), and Dell has published advisory DSA-2025-379 covering the issue.

OS command injection in Dell Unity, Unity XT, and UnityVSA running Unity Operating Environment 5.5 and earlier allows a low-privileged local attacker to execute arbitrary operating-system commands, escalating privileges to full control of the storage appliance. Exploitation requires an existing local account on the system (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and no user interaction; there is no remote or network vector, so the realistic threat model is post-foothold privilege escalation rather than direct remote compromise. EPSS is low at 0.57% (46th percentile) and no public exploit identified at time of analysis; Dell has published advisory DSA-2025-379 covering the fix.

OS command injection in Dell Unity Operating Environment 5.5 and earlier lets an authenticated local user with low privileges execute arbitrary commands as root, but only on arrays running without a valid license. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) confirms the attacker must already hold a foothold on the appliance; there is no network-reachable path and no user interaction is required. Exploitation is sharply limited by the missing-license precondition, EPSS is low at 0.69% (51st percentile), and no public exploit code has been identified at time of analysis.

OS command injection in Dell Unity Operating Environment 5.5 and prior allows an authenticated local low-privileged attacker to execute arbitrary OS commands and elevate privileges. The vulnerability requires local access and a valid low-privilege account, and cannot be triggered remotely. No public exploit code has been identified at time of analysis, and the EPSS score is low (0.57%, 46th percentile), indicating a credible but non-urgent risk for most environments.

OS command injection in the Dell Unity Operating Environment (version 5.4 and prior) allows a locally authenticated, low-privileged user to execute arbitrary operating-system commands and escalate privileges on the appliance. The vulnerability carries a CVSS base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires local access and an existing low-privileged account - remote unauthenticated attackers cannot reach it - but no victim interaction is needed and attack complexity is low, so any tenant with a foothold on the array can attempt to gain full control. There is no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is low at 0.57% (46th percentile), consistent with an operability-bounded, appliance-local flaw rather than a mass-exploitation event. Dell has published a security update advisory (DSA-2025-379) covering Dell Unity, UnityVSA, and Unity XT.

OS command injection in Apache Airflow's bundled `example_dag_decorator` example DAG allows an authenticated web UI user to supply an unvalidated parameter that redirects the example to an attacker-controlled server and executes code on the Airflow worker. Exploitation is narrow: it requires that example DAGs be explicitly enabled in production (not the default, since Airflow ships example loading disabled) or that the vulnerable example code was copied into a user-built DAG, and it further requires the user to trigger an actual DAG run, so only misconfigured or copy-reused environments are realistically exposed. No public exploit has been identified at time of analysis, EPSS is low at 0.49% (~40th percentile), and per NVD the issue is rated modestly (CVSS 3.1 base 4.6), with the independent assessment raising attack complexity to High; the vendor-released fix is Airflow 3.0.5.

NeuVector enforcer containers in the 5.3.x line before 5.3.5 and the 5.4.x line through 5.4.6 contain an OS command injection flaw in the monitor process teardown check, where unsanitized CLUSTER_RPC_PORT and CLUSTER_LAN_PORT environment variables are composed into a shell command executed via popen(). An attacker who can define or modify the enforcer pod's environment can inject commands that run when the container stops; this is not remotely reachable without orchestration-level access, and no public exploit code is identified at time of analysis. The input's 9.9 network-vector CVSS score conflicts with the assessed local high-privilege mechanism and should be treated with caution.

Local privilege escalation in WatchGuard Mobile VPN with SSL client on Windows allows a low-privileged local user to inject and execute arbitrary commands with elevated system privileges via a command injection flaw (CWE-77). This vulnerability is explicitly described as an additional, previously unmitigated attack path for CVE-2024-4944, indicating that the earlier advisory's remediation was incomplete and the underlying injection surface persists in another code path. No public exploit identified at time of analysis, but the local-only attack vector limits exposure to insider threats and post-compromise lateral movement scenarios. A vendor-released patch is available in version 12.11.5.

Arbitrary shell command execution on the Jenkins controller is possible through the Azure CLI Plugin 0.9 and earlier, which does not restrict which commands it runs. An authenticated Jenkins user holding Item/Configure permission can craft a job configuration that causes the plugin to execute attacker-chosen shell commands on the controller, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires no user interaction and no non-default plugin setting. There is no evidence of active exploitation and no public exploit identified at time of analysis, and EPSS is low (0.61%, 48th percentile), though the required privilege is comparatively common in environments where job-configuration rights are broadly granted.

OS command injection in FastMCP versions prior to 2.13.0 allows an attacker who can influence the server_name field of an MCP server to run arbitrary operating-system commands on Windows hosts where the victim executes `fastmcp install cursor`. Exploitation is gated by three prerequisites that must all hold: the host must be Windows (the shell invocation is compiled in only on that platform), the victim must run the Cursor installer command, and the attacker must control or influence the server_name value of the MCP being installed - usually via a shared, published, or otherwise attacker-supplied MCP server. The flaw is fixed in FastMCP 2.13.0; publicly available exploit code exists, but CISA KEV does not list it as actively exploited, EPSS is low at 0.23% (12th percentile), and the assessed impact requires user interaction (CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), making this a genuine but gated code-execution issue rather than a mass-exploitation emergency.

Command injection in the IPFire URL filter allows an authenticated administrator to execute arbitrary shell commands as the unprivileged 'nobody' user by supplying a crafted BE_NAME value when installing a blacklist through the web interface. The flaw affects IPFire releases prior to 2.29 Core Update 198, and exploitation requires a valid GUI session (CVSS PR:L) plus the ability to trigger a blacklist installation, so unauthenticated remote attackers cannot reach the vulnerable code path; no public exploit code was identified at time of analysis, and the resulting command execution is confined to the 'nobody' account rather than root. With a CVSS 4.0 base score of 8.7 (assessed equivalently as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), this is a genuine but credential-gated priority for firewall appliances whose management interface is reachable by untrusted users.

Authenticated command injection in the IPFire firewall distribution prior to 2.29 (Core Update 198) lets a low-privilege WebGUI user run arbitrary shell commands as the 'nobody' service account. When a Proxy (Calamaris) report is generated, the GUI POSTs to /cgi-bin/logs.cgi/calamaris.dat and passes fields such as DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, NUM_DOMAINS and BYTE_UNIT straight into the mkreport helper without sanitization, so shell metacharacters in any of those fields are executed server-side. The issue is remotely reachable but requires valid GUI credentials and access to the firewall's management interface; there is no public exploit identified at time of analysis and no CISA KEV listing, though the assessed CVSS:3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and the reported CVSS 8.7 reflect high confidentiality, integrity and availability impact within the compromised 'nobody' context.

OS command injection in Hitachi Energy TropOS 4th Gen web configuration utility allows an authenticated high-privilege user to inject shell commands through the Diagnostics Tools page and abuse set-uid applications to escalate to root on the device. The flaw requires administrative web access to TropOS 4th Gen and is a post-authentication privilege-escalation issue, not unauthenticated remote compromise. The provided intelligence shows EPSS 0.32% (low), no CISA KEV entry, and no public exploit identified at time of analysis.

Command injection in the Logging page of the web-based configuration utility shipped with Hitachi Energy TropOS 4th Gen devices lets an attacker who already holds a valid low-privileged account execute arbitrary operating-system commands with sufficient privileges to gain root SSH access to the device. Exploitation is network-reachable (CVSS 4.0 AV:N/AC:L/AT:N) but gated by the PR:L authentication requirement, so it is not remotely exploitable without credentials; the independent assessment scores it 8.7 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), making it a credible but not top-tier priority. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is a modest 1.05% (63rd percentile), indicating low observed likelihood of exploitation relative to the breadth of the score.

Command injection in D-Link DI-7001 MINI firmware versions 19.09.19A1 and 24.04.18B1 allows authenticated remote attackers to execute arbitrary commands via the cmd parameter in /msp_info.htm. The vulnerability has a public exploit available, though the extremely low CVSS score (2.1) and EPSS percentile (24th) indicate limited real-world exploitability despite network accessibility, as exploitation requires valid login credentials and results in low-impact information disclosure rather than system compromise.

OS command injection in D-Link DAP-2695 firmware 2.00RC13 allows high-privileged remote attackers to execute arbitrary commands through the Firmware Update Handler function sub_4174B0. The vulnerability carries a low real-world risk despite network-accessible attack vector due to requiring administrative credentials (PR:H) and affecting only end-of-life hardware. Publicly available exploit code exists, though EPSS exploitation probability remains minimal at 0.09th percentile.

Authenticated remote command execution affects the Veeder-Root TLS4B Automatic Tank Gauge (ATG), whose SOAP-based web services handler exposes functionality that allows an attacker with valid credentials on that interface to run system-level commands on the device's underlying Linux operating system. Successful exploitation yields full shell access on the gauge and a foothold for lateral movement into the surrounding OT/fuel-management network. Per the CVSS vector the attack requires network reachability plus valid credentials (PR:L), not pre-auth access, and no user interaction; there is no CISA KEV listing and no public exploit code identified at time of analysis, while EPSS sits at 1.39% (71st percentile) - a moderate, not extreme, likelihood signal. Severity is nevertheless very high (CVSS 9.4 per the 4.0 vector; independent assessment scores CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) because a single compromised credential converts directly into host-level control of a safety- and business-critical tank monitoring device.

Authenticated, high-privileged remote attackers can inject operating system commands through diagnostics functionality in Arista EOS, potentially achieving full compromise of confidentiality, integrity, and availability. CVE-2025-6978 carries a CVSS base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and an EPSS score of 13.43% (96th percentile), indicating elevated exploitation likelihood; however, no public exploit code and no CISA KEV active exploitation have been identified at time of analysis. Our independent assessment considers this a moderate-to-elevated priority issue with partially conflicting signals, and the vendor has published Arista security advisory 0123.

Authenticated command injection in Zoho ManageEngine ADManager Plus allows a logged-in user who can reach the Custom Script component to inject operating system commands that execute on the server. Affected instances are those running builds earlier than 8024 (CPE entries cover 8.0 builds 8001 through 8023), and exploitation requires valid credentials plus sufficient role privileges to access the Custom Script automation feature (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8). There is no public exploit identified at time of analysis and no CISA KEV listing, though an EPSS score of 4.54% (91st percentile) indicates above-average predicted exploitation activity; the underlying weakness is CWE-77 command injection.

Command injection in the optional MediaWiki Springboard extension (master development branch) lets unauthenticated remote attackers execute arbitrary commands on the wiki server, with an assessed impact of high confidentiality, integrity and availability loss. Exposure is limited to installations that have deployed and enabled this non-core, third-party extension while tracking upstream development; stock MediaWiki cores and sites without Springboard are unaffected. EPSS is low at 1.12% (65th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.