#cwe-78

共收录 1612 条相关情报。

漏洞预警2026-10-29 发布CRITICAL

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain...

CVE-2026-90868

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Wind

来源摘录 · NVD

#cve #cwe-78 #cwe-88

漏洞预警2026-10-29 发布CRITICAL

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated...

CVE-2026-90865

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Wind

来源摘录 · NVD

#cve #cwe-78 #cwe-88

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS comm...

CVE-2026-107326

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to impro

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-29 发布MEDIUM

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS c...

CVE-2026-104308

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to im

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-29 发布CRITICAL

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially cra...

CVE-2026-97854

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitra

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-29 发布HIGH

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers ...

CVE-2026-119025

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-29 发布HIGH

Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with ...

CVE-2026-33924

Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient va

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-29 发布HIGH

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions wit...

CVE-2026-118905

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.

来源摘录 · NVD

#cve #cwe-78 #cwe-94

漏洞预警2026-10-29 发布INFO

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of perm...

CVE-2026-66088

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating sy

来源摘录 · NVD

#cve #cwe-749 #cwe-78

安全公告2026-10-28 发布HIGH

systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

CVE-2026-116576

### Summary On Windows, `systeminformation@5.33.15` builds a PowerShell command using the value passed to `services()`.

来源摘录 · GitHub Advisory

#advisory #cwe-78 #npm #severity:high

漏洞预警2026-10-28 发布CRITICAL

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login:...

CVE-2026-61567

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an a

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布HIGH

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder pa...

CVE-2026-118755

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticate

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布HIGH

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in...

CVE-2026-118692

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布HIGH

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary comm...

CVE-2026-78674

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布HIGH

Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations...

CVE-2026-118615

Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote atta

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布MEDIUM

Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX...

CVE-2026-118607

Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerability allows physically present attackers to execu

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布HIGH

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session...

CVE-2026-106079

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessMan

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布CRITICAL

An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attack...

CVE-2026-103406

An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Junipe

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布HIGH

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session...

CVE-2026-103403

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessMan

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-28 发布HIGH

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who posse...

CVE-2026-116778

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1,

来源摘录 · NVD

#cve #cwe-78 #cwe-862