Export limit exceeded: 389720 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 10074 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 22490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (22490 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-52010 | 2026-04-15 | N/A | ||
| Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. Zoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH servers from their browsers. In HandleCreateProxySession the request to create an SSH session is handled. An attacker can exploit the username variable to escape from the bash command and inject arbitrary commands into sshCommand. This is possible, because, unlike hostname and port, the username is not validated or sanitized. | ||||
| CVE-2024-52034 | 1 Myscada | 2 Mypro Manager, Mypro Runtime | 2026-04-15 | 10 Critical |
| An OS Command Injection vulnerability exists within myPRO Manager. A parameter within a command can be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands. | ||||
| CVE-2024-52320 | 1 Planet Technology Corp | 1 Wgs-804hpt Firmware | 2026-04-15 | 9.8 Critical |
| The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result in remote code execution. | ||||
| CVE-2024-5421 | 2026-04-15 | N/A | ||
| Missing input validation and OS command integration of the input in the utnserver Pro, utnserver ProMAX, INU-100 web-interface allows authenticated command injection.This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below. | ||||
| CVE-2024-55884 | 2026-04-15 | 9 Critical | ||
| In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhausted, leading to heap-based out-of-bounds writes in enable() in exception_logging/unix.rs, aka MLLVD-CR-24-01. NOTE: achieving code execution is considered non-trivial. | ||||
| CVE-2025-54314 | 2026-04-15 | 2.8 Low | ||
| Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments." | ||||
| CVE-2024-5672 | 2026-04-15 | 7.2 High | ||
| A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an OS command. | ||||
| CVE-2024-57595 | 1 Dlink | 1 Dir-825 | 2026-04-15 | 9.8 Critical |
| DLINK DIR-825 REVB 2.03 devices have an OS command injection vulnerability in the CGl interface apc_client_pin.cgi, which allows remote attackers to execute arbitrary commands via the parameter "wps_pin" passed to the apc_client_pin.cgi binary through a POST request. | ||||
| CVE-2020-36877 | 1 Request | 1 Serious Play Pro | 2026-04-15 | N/A |
| ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server user. Attackers can upload PHP executable files via the Quick File Uploader page, resulting in remote code execution on the server. | ||||
| CVE-2024-6048 | 1 Openfind | 2 Mailaudit, Mailgates | 2026-04-15 | 9.8 Critical |
| Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments. An unauthenticated remote attacker can exploit this vulnerability to inject system commands and execute them on the remote server. | ||||
| CVE-2024-4301 | 2026-04-15 | 8.8 High | ||
| N-Reporter and N-Cloud, products of the N-Partner, have an OS Command Injection vulnerability. Remote attackers with normal user privilege can execute arbitrary system commands by manipulating user inputs on a specific page. | ||||
| CVE-2025-0236 | 2026-04-15 | 5.3 Medium | ||
| Out-of-bounds vulnerability in slope processing during curve rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver. | ||||
| CVE-2025-0034 | 1 Amd | 2 Instinct Mi300x, Instinct Mi325x | 2026-04-15 | 4.7 Medium |
| Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cause read or write past the end of allocated arrays, potentially resulting in a loss of platform integrity or denial of service. | ||||
| CVE-2025-0127 | 1 Paloaltonetworks | 1 Pan-os | 2026-04-15 | N/A |
| A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. This issue is only applicable to PAN-OS VM-Series. This issue does not affect firewalls that are already deployed. Cloud NGFW and Prisma® Access are not affected by this vulnerability. | ||||
| CVE-2025-0234 | 2026-04-15 | 5.3 Medium | ||
| Out-of-bounds vulnerability in curve segmentation processing of Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver. | ||||
| CVE-2025-0235 | 2026-04-15 | 5.3 Medium | ||
| Out-of-bounds vulnerability due to improper memory release during image rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver. | ||||
| CVE-2025-10239 | 1 Progress | 1 Flowmon | 2026-04-15 | 7.2 High |
| In Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interface to execute additional unintended commands within scripts intended for troubleshooting purposes. | ||||
| CVE-2025-10680 | 1 Openvpn | 1 Openvpn | 2026-04-15 | 8.8 High |
| OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use | ||||
| CVE-2025-10774 | 1 Ruijie | 2 Rg-uac 6000-e10, Rg-uac 6000-e10 Firmware | 2026-04-15 | 4.7 Medium |
| A weakness has been identified in Ruijie 6000-E10 up to 2.4.3.6-20171117. This affects an unknown part of the file /view/vpn/autovpn/sub_commit.php. This manipulation of the argument key causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-11141 | 1 Ruijie | 1 Nbr2100g-e | 2026-04-15 | 4.7 Medium |
| A security flaw has been discovered in Ruijie NBR2100G-E up to 20250919. Affected by this issue is the function listAction of the file /itbox_pi/branch_passw.php?a=list. Performing manipulation of the argument city results in os command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way. | ||||