Everything Threat Times has reported about OS command injection: 12 stories, newest first. Part of our Vulnerabilities coverage.
The National Vulnerability Database lists a critical OS command injection flaw in Wavlink router firmware, noting that the exploit has been published and the vendor was notified early.
National Vulnerability Database records CVE-2020-37279 as a critical risk in the Node.js library, enabling arbitrary OS command execution through manipulated file paths.
Unauthenticated attackers can execute arbitrary system commands via manipulated output folder paths in versions of GPT-SoVITS through 20250606v2pro.
A critical vulnerability in Linksys E1700 firmware allows remote OS command injection via IPv6 inputs, with no vendor response or fix confirmed.
A CVSS 9.4 vulnerability in Linksys E1700 firmware allows remote command injection via static route settings, with public exploits available.
TRENDnet confirms a critical OS command injection flaw in three end-of-life routers, noting the devices were discontinued in 2011 and no patch will be issued.
Amazon Web Services disclosed a command injection flaw in the ECS Agent that affects users with FSx Windows File Server volumes.
An unauthenticated endpoint in Dromara Skyeye allows remote attackers to execute PowerShell commands via a format parameter vulnerability rated critical.
A remote unauthenticated attacker could execute arbitrary OS commands via a crafted database command in vulnerable plugin versions.
A critical vulnerability in ppt2png allows remote attackers to execute arbitrary system commands via unsanitized file path arguments.
The @enmaso/node-convert package contains a severe vulnerability allowing remote attackers to execute arbitrary system commands via crafted inputs.
A critical vulnerability in the image_optimizer Ruby gem allows attackers to execute arbitrary commands via crafted file paths.