OS Command Injection

CWE-78 · 9 records · 7 with a public proof-of-concept

Records the NVD classes as OS Command Injection (CWE-78), highest CVSS first.

  1. CRITICAL 9.8CVE-2026-66902public PoC2026-08-04

    Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call. The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a…

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 8.8CVE-2026-71243public PoC2026-08-05

    The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " + path.join(info.destination, info.name) + "; " - and executes the resulting string through a shel…

    AI risk analysis on Exploit-DB.ai →

  3. HIGH 8.8CVE-2026-70375public PoC2026-08-05

    HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly in…

    AI risk analysis on Exploit-DB.ai →

  4. HIGH 8.8CVE-2026-70374public PoC2026-08-05

    HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(file…

    AI risk analysis on Exploit-DB.ai →

  5. HIGH 8.8CVE-2026-167932026-08-04

    An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged…

    AI risk analysis on Exploit-DB.ai →

  6. HIGH 7.8CVE-2026-16022public PoC2026-08-05

    @oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into…

    AI risk analysis on Exploit-DB.ai →

  7. HIGH 7.2CVE-2026-71284public PoC2026-08-05

    Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell a…

    AI risk analysis on Exploit-DB.ai →

  8. HIGH 7.2CVE-2026-18900public PoC2026-08-05

    A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit h…

    AI risk analysis on Exploit-DB.ai →

  9. MEDIUM 4.7CVE-2026-134772026-08-05

    IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.

    qradar security information and event manager

    AI risk analysis on Exploit-DB.ai →