tag
Os-Command-Injection
Nagios XI 5.5.6–5.7.5 Authenticated OS Command Injection — Windows WMI Config Wizard (CVE-2021-25296)
Nagios XI's "Windows WMI" configuration wizard (/usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php) builds a WMI-check shell command using several attacker-supplied HTTP parameters, including pluginoutputlen. The value is never…
Nagios XI 5.5.6–5.7.5 Authenticated OS Command Injection — Switch Config Wizard (CVE-2021-25297)
Nagios XI's "Switch" configuration wizard (/usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php) generates an MRTG configuration snippet for the monitored switch and writes it into an MRTG config file using a shell sed command built from…
Nagios XI 5.5.6–5.7.5 Authenticated OS Command Injection — Cloud-VM Config Wizard (CVE-2021-25298)
Nagios XI's "Cloud/VM" configuration wizard (/usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php) performs a reachability check against an attacker-supplied host address by shelling out to ping. The address parameter is concatenated…
D-Link AX1500 SetDeviceSettings `DeviceName` OS Command Injection (CVE-2025-60854)
The D-Link AX1500 web management interface exposes a SetDeviceSettings SOAP action (reached via the /DHMAPI/ HNAP-style endpoint) that lets a client update the router's DeviceName. The vulnerable firmware function (identified in the binary as…
FortiSandbox 4.4.0-4.4.8 — OS Command Injection via tracer-behavior Endpoint (CVE-2026-39808)
FortiSandbox versions 4.4.0 through 4.4.8 contain a critical OS command injection vulnerability in the tracer-behavior API endpoint (job-detail/tracer-behavior), reachable via the jid request parameter. Improper neutralization of special shell characters…
Dolibarr ERP/CRM OS Command Injection via MAIN_ODT_AS_PDF (CVE-2026-23500)
Dolibarr's ODT-to-PDF document conversion feature builds a shell command by concatenating the admin-configurable MAINODTASPDF global setting with a sanitized filename before passing it to PHP's exec(). While the filename argument is escaped with…
Ivanti Sentry Pre-Auth RCE + Auth Bypass (CVE-2026-10520 / CVE-2026-10523)
Two critical vulnerabilities in Ivanti Sentry enable unauthenticated root-level RCE and arbitrary admin account creation. CVE-2026-10520 is an OS command injection in the MICS API at /mics/api/v2/sentry/mics-config/handleMessage (CVSS 10.0). CVE-2026-10523 is…