Base de CVEs

CVE-2026-27602 Alta · 7.2 CWE-78 25/03/2026

Modoboa has an OS Command Injection

Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server. Version 2.7.1 patches the issue.

CVE-2026-26833 Crítica · 9.8 CWE-78 25/03/2026

OS Command Injection em Mmahrous Thumbler

thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to child_process.exec() without proper sanitization or escaping.

CVE-2026-26832 Crítica · 9.8 CWE-78 25/03/2026

OS Command Injection em Zapolnoch Tesseract Ocr

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper sanitization

CVE-2026-26831 Crítica · 9.8 CWE-78 25/03/2026

OS Command Injection em Dbashford Textract

textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization

CVE-2026-33412 Alta · 7.3 CWE-78 24/03/2026

Vim affected by Command injection via newline in glob()

Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.

CVE-2026-32948 Alta · 7.8 CWE-78 24/03/2026

sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows

sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands. This issue has been patched in version 1.12.7.

CVE-2026-23920 Alta · 8.8 CWE-78 24/03/2026

Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection

Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.

CVE-2025-11571 Baixa · 2.1 CWE-78 24/03/2026

Command Execution vulnerability in Simplicity Installer

Vulnerable endpoints accept user-controlled input through a URL in JSON format which enables command execution. The commands allowed to execute can open executables. However, the commands cannot pass parameters or arguments. To successfully execute this attack, the attacker needs to be on the same network.

CVE-2026-33310 Alta · 8.8 CWE-78 24/03/2026

Intake has a Command Injection via shell() Expansion in Parameter Defaults

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed. This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system. Version 2.0.9 mitigates the issue by making getshell False by default everywhere.

CVE-2026-4611 Alta · 8.8 CWE-78 23/03/2026

TOTOLINK X6000R shttpd setLanCfg privilege escalation

A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the function setLanCfg of the file /usr/sbin/shttpd. Executing a manipulation of the argument Hostname can lead to os command injection. The attack may be launched remotely.

CVE-2026-23882 Alta · 7.2 CWE-78 23/03/2026

Blinko: Admin RCE - MCP Server Command Injection

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP (Model Context Protocol) server creation function allows specifying arbitrary commands and arguments, which are executed when testing the connection. This issue has been patched in version 1.8.4.

CVE-2026-33648 Alta · 8.8 CWE-78 23/03/2026

AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the restreamer endpoint constructs a log file path by embedding user-controlled `users_id` and `liveTransmitionHistory_id` values from the JSON request body without any sanitization. This log file path is then concatenated directly into shell commands passed to `exec()`, allowing an authenticated user to achieve arbitrary command execution on the server via shell metacharacters such as `$()` or backticks. Commit 99b865413172045fef6a98b5e9bfc7b24da11678 contains a patch.

CVE-2025-15519 Alta · 7.2 CWE-78 23/03/2026

Command Injection in Modem Management CLI on TP-Link Archer NX200, NX210, NX500 and NX600

Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device.

CVE-2025-15518 Alta · 7.2 CWE-78 23/03/2026

Command Injection in Wireless Control CLI on TP-Link Archer NX200, NX210, NX500 and NX600

Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device.

CVE-2026-33482 Alta · 8.1 CWE-78 23/03/2026

AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&&`, `;`, `|`, `` ` ``, `<`, `>`). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.

CVE-2026-33478 Crítica · 10.0 Exploit público CWE-78 23/03/2026

WWBN AVideo: RCE sem autenticação via cadeia do CloneSite e injeção de comando

AVideo da WWBN é uma plataforma de vídeo de código aberto. Nas versões até a 26.0 inclusive, múltiplas vulnerabilidades na cadeia de plugins CloneSite do AVideo se combinam para permitir que um atacante totalmente não autenticado alcance execução remota de código. O endpoint `clones.json.php` expõe chaves secretas de clones sem autenticação, que podem ser usadas para disparar um dump completo do banco de dados via `cloneServer.json.php`. O dump contém hashes de senhas de administrador armazenados como MD5, que são trivialmente quebráveis. Com acesso de administrador, o atacante explora uma injeção de comando do sistema operacional na construção do comando rsync em `cloneClient.json.php` para executar comandos arbitrários no sistema. O commit c85d076375fab095a14170df7ddb27058134d38c contém um patch.

CVE-2026-32968 Crítica · 9.8 CWE-78 23/03/2026

Injeção de comando de SO não autenticada (RCE) em com_mb24sysapi

Devido à neutralização imprópria de elementos especiais usados em um comando do sistema operacional, um invasor remoto não autenticado pode explorar uma vulnerabilidade de RCE no módulo com_mb24sysapi, resultando em comprometimento total do sistema. Esta vulnerabilidade é uma variante de ataque do CVE-2020-10383.

CVE-2026-4554 Alta · 8.8 CWE-78 22/03/2026

Tenda F453 WriteFacMac FormWriteFacMac privilege escalation

A security flaw has been discovered in Tenda F453 1.0.0.3. The affected element is the function FormWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-33319 Alta · 7.5 CWE-78 22/03/2026

AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

WWBN AVideo is an open source video platform. Prior to version 26.0, the `uploadVideoToLinkedIn()` method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via `escapeshellarg()`. If an attacker can influence the LinkedIn API response (via MITM, compromised OAuth token, or API compromise), they can inject arbitrary OS commands that execute as the web server user. Version 26.0 contains a fix for the issue.

CVE-2026-32056 Crítica · 9.8 CWE-78 20/03/2026

OpenClaw - Execução remota de código por injeção de variáveis de ambiente de inicialização de shell em system.run

As versões do OpenClaw anteriores a 2026.2.22 não higienizam as variáveis de ambiente de inicialização de shell HOME e ZDOTDIR na função system.run, permitindo que atacantes contornem as proteções de lista de permissões de comandos. Atacantes remotos podem injetar arquivos de inicialização maliciosos, como .bash_profile ou .zshenv, para alcançar execução arbitrária de código antes que os comandos avaliados pela lista de permissões sejam executados.

CVE-2026-33154 Alta · 8.1 CWE-78 20/03/2026

dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver

dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.

CVE-2025-63261 Alta · 7.8 CWE-78 20/03/2026

OS Command Injection em Awstats

AWStats 8.0 is vulnerable to Command Injection via the open function

CVE-2026-4499 Crítica · 9.8 CWE-78 20/03/2026

D-Link DIR-820LW SSDP ssdpcgi_main os command injection

A vulnerability was determined in D-Link DIR-820LW 2.03. Affected is the function ssdpcgi_main of the component SSDP. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-4497 Crítica · 9.8 CWE-78 20/03/2026

Totolink WA300 cstecgi.cgi recvUpgradeNewFw os command injection

A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. Affected by this issue is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi. This manipulation causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CVE-2026-22902 Média · 6.7 CWE-78 20/03/2026

QuNetSwitch

A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later