#CWE-78
All CosmicBytez Labs articles tagged #CWE-78, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-108576: Unauthenticated OS Command Injection in TOZED X300 Router (CVSS 10.0)
A maximum-severity flaw in TOZED X300 firmware ≤ 6.01.3 lets unauthenticated attackers inject OS commands via the IPPingDiagnostics Host field.
- Security
CVE-2026-108540: Critical OS Command Injection in OpenSpug Spug's File Transfer Component
OpenSpug Spug through 4.0.1 lets attackers inject OS commands via /exec/transfer, with public PoC exploit code and CVSS 9.9.
- Security
CVE-2026-6837: Zyxel WAX650S Post-Auth Command Injection (CVSS 7.2)
A post-authentication command injection vulnerability in the Zyxel WAX650S Wi-Fi 6 access point allows authenticated administrators to execute arbitrary...
- Security
CVE-2026-12486: GeoVision GV-I/O Box 4E OS Command Injection via libNetSetObj.so
Multiple OS command injection vulnerabilities in GeoVision GV-I/O Box 4E firmware 2.09 allow attackers with network access to execute arbitrary system...
- Security
CVE-2026-25244 — WebdriverIO Command Injection RCE via Git
A command injection vulnerability in WebdriverIO below version 9.24.0 allows remote code execution through malicious git branch names containing shell...
- Security
CVE-2026-27130 — Dokploy OS Command Injection via appName
Dokploy versions 0.26.6 and below contain a critical OS command injection vulnerability in the appName parameter, enabling unauthenticated remote code...
- Security
CVE-2026-8153: Universal Robots PolyScope OS Command
A critical OS command injection flaw in Universal Robots PolyScope Dashboard Server (CVSS 9.8) allows unauthenticated attackers to execute arbitrary...
- Security
CVE-2026-7037: Unauthenticated OS Command Injection in Totolink A8000RU
A critical CVSS 9.8 OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary...
- Security
CVE-2026-6951: simple-git RCE via --config Option Bypass
A critical remote code execution vulnerability in the simple-git npm package allows attackers to inject arbitrary git config options via the --config...
- Security
CVE-2021-4473: Tianxin Behavior Management System
A critical unauthenticated command injection vulnerability in the Tianxin Internet Behavior Management System's Reporter component allows attackers to...
- Security
CVE-2026-0596: MLflow Command Injection via Unsanitized
A critical command injection vulnerability in mlflow/mlflow allows attackers to execute arbitrary shell commands by embedding metacharacters in the...
- Security
CVE-2026-30303 — Axon Code OS Command Injection via Whitelist Bypass
The command auto-approval module in Axon Code contains an OS Command Injection vulnerability. An incompatible Unix-based shell-quote parser is used on...
- Security
CVE-2026-33478: AVideo CloneSite Plugin Unauthenticated RCE
A critical chain of vulnerabilities in WWBN AVideo's CloneSite plugin allows fully unauthenticated attackers to achieve remote code execution via key...
- Security
CVE-2026-32238: Critical Command Injection in OpenEMR
OpenEMR versions prior to 8.0.0.2 contain a CVSS 9.1 command injection vulnerability in the backup functionality. Authenticated attackers with high...
- Security
CVE-2026-32298: Angeet ES3 KVM OS Command Injection via cfg.lua Script
A high-severity OS command injection vulnerability (CVSS 9.1) in the Angeet ES3 KVM switch allows authenticated attackers to execute arbitrary OS-level...