CWE-78

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection vulnerability that

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb dri

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attack

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticat

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain na

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitra

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone

IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elev

systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is v

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command exe

Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attack

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated term

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the termin

Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could al

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to e

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option p

OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail genera

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDe

The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, dest

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to i

An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execut

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backu

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, settings.readTraefikFile in apps/dokplo

A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute

A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by expl

Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm al

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated at

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shel

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository,

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elev

IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of special el