#cwe-78

共收录 1612 条相关情报。

漏洞预警2026-10-13 发布HIGH

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with...

CVE-2026-104085

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors t

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-13 发布INFO

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow wit...

CVE-2026-55376

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-94 #cwe-693

漏洞预警2026-10-13 发布INFO

CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.

CVE-2026-77099

CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenanc

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-10-13 发布INFO

heym Python Tool Sandbox Escape

CVE-2026-55376

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-693 #cwe-78 #cwe-94

漏洞预警2026-10-13 发布INFO

A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command inject...

CVE-2026-109110

A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemo

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-10-13 发布INFO

A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument...

CVE-2026-109108

A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-10-13 发布INFO

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG dev...

CVE-2026-75826

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUT

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-10-13 发布INFO

The affected code used child_process.execSync with a shell string for generator installation and...

CVE-2026-89116

The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This al

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-78 #severity:medium

漏洞预警2026-10-13 发布INFO

The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with t...

CVE-2026-89116

The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This al

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-12 发布INFO

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in ...

CVE-2026-82096

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands du

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-12 发布INFO

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value p...

CVE-2026-18529

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-12 发布INFO

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder p...

CVE-2025-71429

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthen

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-12 发布INFO

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, ...

CVE-2020-37279

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute comma

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-12 发布INFO

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions i...

CVE-2026-109318

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-10-12 发布INFO

Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author

CVE-2026-109318

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78

漏洞预警2026-10-12 发布INFO

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix...

CVE-2026-108896

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/set

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-10-12 发布INFO

A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC...

CVE-2026-108895

A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /go

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-10-12 发布INFO

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYA...

CVE-2026-18390

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-12 发布INFO

A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handle...

CVE-2026-108894

A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /g

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-10-12 发布INFO

mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into execute_...

CVE-2026-108953

mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command

历史摘要 · 未重新核验 · NVD

#cve #cwe-78