#cwe-78

共收录 1612 条相关情报。

← 返回所有主题

漏洞预警2026-09-16 发布INFO

A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution of commands with ...

CVE-2026-27550

A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-16 发布INFO

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing exec...

CVE-2026-27549

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-16 发布INFO

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing exe...

CVE-2026-27548

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-16 发布INFO

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowi...

CVE-2026-27547

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-16 发布INFO

A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC...

CVE-2026-73447

A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-09-16 发布INFO

Insufficient validation of inputs supplied through affected VeloCloud Edge management and...

CVE-2026-86108

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may al

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-78 #severity:high

漏洞预警2026-09-16 发布INFO

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration val...

CVE-2026-86108

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may al

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-09-16 发布INFO

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute...

CVE-2026-10144

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands b

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-78 #severity:high

漏洞预警2026-09-15 发布INFO

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters...

CVE-2026-10144

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands b

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-15 发布INFO

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates gi...

CVE-2026-58502

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow r

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-15 发布INFO

An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cg...

CVE-2026-52484

An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenticated attacker to execute arbitrary code

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-15 发布INFO

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type...

CVE-2026-91853

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvp

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-09-15 发布INFO

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated into shell run bl...

CVE-2026-91936

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_di

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-15 发布INFO

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package...

CVE-2026-91931

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated att

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-15 发布INFO

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEP...

CVE-2026-85013

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-15 发布INFO

CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in code_rag/entry/cli.py calls s...

CVE-2026-57586

CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-15 发布INFO

Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git for...

CVE-2026-55158

Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1,

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-15 发布INFO

An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to execute arbitrary commands on the underlying operating system...

CVE-2026-89308

An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to exec

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-15 发布INFO

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-de...

CVE-2026-57136

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/s

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-693 #cwe-863

漏洞预警2026-09-15 发布INFO

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell() helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-de...

CVE-2026-57133

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell() helper exported from src/praisonai-ts/src/t

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-693 #cwe-863