CWE-78

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configurat

Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory change

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critic

Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== ins

Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1

The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authen

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior

Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerabi

baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in t

Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injecti

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versio

A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrati

The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthentica

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versio

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE)

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install

HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string arg

The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting a

In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09

Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an O

Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerabilit

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrato

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log

Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker

Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Co

A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the comma

A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain con

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to v

Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell meta

Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Ene

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Ene

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0

Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard

FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 contains an authenticated OS command injection vulnerability that