#cwe-78

共收录 1612 条相关情报。

漏洞预警2026-09-29 发布INFO

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user to execute arbitra...

CVE-2026-84436

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowi

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-29 发布INFO

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing an authenticated privileged CLI user...

CVE-2026-84422

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion fun

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-29 发布INFO

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell comman...

CVE-2022-51019

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-09-29 发布INFO

Akaunting before 2.1.31 OS Command Injection via app alias

CVE-2022-51019

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78

漏洞预警2026-09-29 发布INFO

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its...

CVE-2026-86035

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 202

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-88

安全公告2026-09-29 发布INFO

Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

CVE-2026-86035

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 202

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78 #cwe-88

漏洞预警2026-09-29 发布INFO

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. ...

CVE-2026-82804

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharac

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-29 发布INFO

OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls repository...

CVE-2026-102437

OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasoni

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-09-29 发布INFO

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

CVE-2026-102437

OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasoni

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78

漏洞预警2026-09-29 发布HIGH

shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later...

CVE-2026-102422

shell-quote 是广泛使用的 Node.js 库，用于解析和引用 shell 命令字符串。其 quote() 函数在遇到 { comment: '...' } 类型 token 时会输出 # 加注释内容，导致该行后续内容被 shel

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-29 发布INFO

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The mani...

CVE-2026-102240

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/n

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-09-29 发布INFO

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/del_ovpncfg.php of the...

CVE-2026-101859

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escap

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-09-29 发布INFO

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of ...

CVE-2026-101858

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of t

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

安全公告2026-09-28 发布INFO

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all...

CVE-2026-87741

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and inclu

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-78 #severity:high

漏洞预警2026-09-28 发布INFO

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cp_display_pre...

CVE-2026-87741

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and inclu

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-28 发布INFO

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbit...

CVE-2026-75600

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-28 发布INFO

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-o...

CVE-2026-55157

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge gra

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-28 发布INFO

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the...

CVE-2026-54674

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP)

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-28 发布INFO

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold (MoH) module contains a critical security flaw that allows authenticated attacke...

CVE-2026-45562

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold (MoH) module contains a

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-09-28 发布INFO

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

CVE-2026-55157

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge gra

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78