#cwe-78

共收录 1648 条相关情报。

漏洞预警2026-05-19 发布INFO

A command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and including v7.7. The CGI component allows authenticated users to e...

CVE-2026-36828

A command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and includin

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-05-19 发布INFO

A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. The web management interface invokes the backend helper /usr/sbin/pappiw and passes user-...

CVE-2026-36827

A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. The web management interface inv

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-05-18 发布INFO

Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection through the appName parameter. 3 chained issues cause this pro...

CVE-2026-27130

Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-05-18 发布INFO

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vuln...

CVE-2026-25244

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appiu

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-05-17 发布INFO

A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name In...

CVE-2026-8767

A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/pre

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

安全公告2026-05-15 发布INFO

AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

CVE-2026-45578

## Summary **Type:** Classic shell-metacharacter injection. The YPTSocket notification branch in `plugin/Live/on_publis

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-78 #severity:high

漏洞预警2026-05-15 发布INFO

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before 1.0.233 automatically confirms ZMODEM protocol detection on all terminal ses...

CVE-2026-45036

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before 1.0.233 automatical

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-05-15 发布INFO

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The U...

CVE-2026-45035

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the ha

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-05-15 发布INFO

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code...

CVE-2026-41553

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "d

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-78 #severity:critical

漏洞预警2026-05-15 发布INFO

Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tg...

CVE-2026-46483

Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimu

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-88

漏洞预警2026-05-15 发布INFO

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization. An unauthenticated attacker ...

CVE-2026-41553

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "d

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-05-15 发布INFO

Improper input validation in Delphix Continuous Data connectors allows an authenticated user to...

CVE-2026-8654

Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operat

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-78 #severity:high

漏洞预警2026-05-15 发布INFO

Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.

CVE-2026-8654

Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operat

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-05-14 发布INFO

python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values dire...

CVE-2026-45369

python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-05-14 发布INFO

HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString() function in convertCore.php is missing backtick (`) ...

CVE-2026-44666

HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeStri

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-05-14 发布INFO

utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

CVE-2026-45369

## Summary The `_substitute_utcp_args` method in `cli_communication_protocol.py` inserts user-controlled `tool_args` va

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-78 #severity:critical

漏洞预警2026-05-14 发布INFO

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execut...

CVE-2026-26191

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-05-14 发布INFO

mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command execution vulnerability. Due to the lack of authentication ...

CVE-2026-41315

mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-862

漏洞预警2026-05-14 发布INFO

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes ...

CVE-2026-42589

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-05-14 发布INFO

Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small CGI...

CVE-2026-8500

Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small CGI application for managing ht

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-78