Base de CVEs

CVE-2026-28673 Alta · 7.2 CWE-78 17/03/2026

xiaoheiFS Vulnerable to RCE via Unrestricted Plugin Installation (Manifest Manipulation)

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows admins to upload a ZIP file containing a binary and a `manifest.json`. The server trusts the `binaries` field in the manifest and executes the specified file without any validation of its contents or behavior, leading to Remote Code Execution (RCE). Version 0.4.0 fixes the issue.

CVE-2026-32298 Crítica · 9.1 CWE-78 17/03/2026

Injeção de comando do SO no Angeet ES3 KVM

O Angeet ES3 KVM não sanitiza adequadamente variáveis fornecidas pelo usuário que são analisadas pelo script 'cfg.lua', permitindo que um atacante autenticado execute comandos em nível de sistema operacional.

CVE-2026-23759 Alta · 7.2 CWE-78 17/03/2026

Perle IOLAN STS/SCS Authenticated Command Injection via 'shell ps'

Perle IOLAN STS/SCS terminal server models with firmware versions prior to 6.0 allow authenticated OS command injection via the restricted shell accessed over Telnet or SSH. The shell 'ps' command does not perform proper argument sanitization and passes user-supplied parameters into an 'sh -c' invocation running as root. An authenticated attacker who can log in to the device can inject shell metacharacters after the 'ps' subcommand to execute arbitrary OS commands with root privileges, leading to full compromise of the underlying operating system.

CVE-2026-4253 Alta · 7.2 CWE-78 16/03/2026

Tenda AC8 Web UploadCfg route_set_user_policy_rule os command injection

A security flaw has been discovered in Tenda AC8 16.03.50.11. This affects the function route_set_user_policy_rule of the file /cgi-bin/UploadCfg of the component Web Interface. The manipulation of the argument wans.policy.list1 results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-3227 Média · 6.8 CWE-78 16/03/2026

Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N

A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing. Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.

CVE-2026-31386 Alta · 7.2 CWE-78 16/03/2026

OS Command Injection em Litespeedtech Litespeed Web Server

OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.

CVE-2025-15060 Crítica · 9.8 CWE-78 16/03/2026

claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability

claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of claude-hovercraft. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the executeClaudeCode method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27785.

CVE-2026-32260 Crítica · 9.8 CWE-78 12/03/2026

Injeção de comando no node:child_process do Deno via lista incompleta de metacaracteres de shell

O Deno é um runtime de JavaScript, TypeScript e WebAssembly. De 2.7.0 a 2.7.1, existe uma vulnerabilidade de injeção de comando no polyfill node:child_process do Deno (modo shell: true) que contorna a correção do CVE-2026-27190. A sanitização de argumentos em duas etapas em transformDenoShellCommand (ext/node/polyfills/internal/child_process.ts) tem um erro de prioridade: quando um argumento contém um padrão $VAR, ele é envolvido em aspas duplas (L1290) em vez de aspas simples. Aspas duplas no POSIX sh não suprimem a substituição de comando por crase, permitindo que comandos injetados sejam executados. Um atacante que controla argumentos passados a spawnSync ou spawn com shell: true pode executar comandos arbitrários do sistema operacional, contornando o sistema de permissões do Deno. Esta vulnerabilidade está corrigida na versão 2.7.2.

CVE-2026-3841 Alta · 8.8 CWE-78 12/03/2026

Command Injection Vulnerability in Telnet CLI on TP-Link TL-MR6400

A command injection vulnerability has been identified in the Telnet command-line interface (CLI) of TP-Link TL-MR6400 v5.3. This issue is caused by insufficient sanitization of data processed during specific CLI operations. An authenticated attacker with elevated privileges may be able to execute arbitrary system commands. Successful exploitation may lead to full device compromise, including potential loss of confidentiality, integrity, and availability.

CVE-2026-28384 Crítica · 9.9 CWE-78 12/03/2026

Authenticated RCE via unsanitized compression_algorithm

An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.

CVE-2026-31975 Crítica · 9.8 CWE-78 11/03/2026

Cloud CLI WebSocket shell injection

Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.25.0, OS Command Injection via WebSocket Shell. Both projectPath and initialCommand in server/index.js are taken directly from the WebSocket message payload and interpolated into a bash command string without any sanitization, enabling arbitrary OS command execution. A secondary injection vector exists via unsanitized sessionId. This vulnerability is fixed in 1.25.0.

CVE-2026-31862 Alta · 8.8 CWE-78 11/03/2026

Cloud CLI has Command Injection via Multiple Parameters

Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.24.0, multiple Git-related API endpoints use execAsync() with string interpolation of user-controlled parameters (file, branch, message, commit), allowing authenticated attackers to execute arbitrary OS commands. This vulnerability is fixed in 1.24.0.

CVE-2026-31854 Alta · 8.8 CWE-78 11/03/2026

Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypass

Cursor is a code editor built for programming with AI. Prior to 2.0 ,if a visited website contains maliciously crafted instructions, the model may attempt to follow them in order to “assist” the user. When combined with a bypass of the command whitelist mechanism, such indirect prompt injections could result in commands being executed automatically, without the user’s explicit intent, thereby posing a significant security risk. This vulnerability is fixed in 2.0.

CVE-2026-20040 Alta · 8.8 CWE-78 11/03/2026

Cisco IOS XR Software CLI Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the prompt. A successful exploit could allow the attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system.

CVE-2025-67041 Alta · 7.2 CWE-78 11/03/2026

Lantronix EDS3000PS OS Command Injection

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.

CVE-2025-67038 Crítica · 9.8 KEV Alta · 69 Exploit público CWE-78 11/03/2026

Lantronix EDS5000 Code Injection Vulnerability

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

CVE-2025-67037 Alta · 7.2 CWE-78 11/03/2026

Lantronix EDS5000, G520, and X300 OS Command Injection

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when killing a tunnel connection. Injected commands are executed with root privileges.

CVE-2025-67036 Alta · 7.2 CWE-78 11/03/2026

Lantronix EDS5000, G520, and X300 OS Command Injection

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges.

CVE-2025-67035 Alta · 7.2 CWE-78 11/03/2026

Lantronix EDS5000 OS Command Injection

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys, users, and known hosts. Commands are executed with root privileges.

CVE-2025-67034 Alta · 7.2 CWE-78 11/03/2026

Lantronix EDS5000, G520, and X300 OS Command Injection

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.

CVE-2024-14026 Alta · 7.8 CWE-78 11/03/2026

QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.3.3006 build 20250108 and later QuTS hero h5.1.9.2954 build 20241120 and later QuTS hero h5.2.3.3006 build 20250108 and later

CVE-2026-23816 Alta · 8.8 CWE-78 11/03/2026

Authenticated Command Injection found in admin AOS-CX CLI command

A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-28292 Crítica · 9.8 CWE-78 10/03/2026

simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.

CVE-2026-25836 Alta · 7.2 CWE-78 10/03/2026

OS Command Injection em Fortinet FortiSandbox Cloud

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with super-admin profile and CLI access to execute unauthorized code or commands via crafted HTTP requests.

CVE-2025-66178 Alta · 7.2 CWE-78 10/03/2026

A improper neutralization of special elements used in an os command ('os command injection')...

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow an authenticated attacked to execute arbitrary commands via a specialy crafted HTTP request.