Command-Injection

Admin creds from the database, command injection in the add-customer form for a shell, then a SUID find for root.

A client-side filter was the only thing guarding command execution. Past it was a file read to SSH keys, then a SUID gawk for root.

Cisco NDFC insufficiently validates command arguments, letting an authenticated attacker with network-admin privileges inject arguments that corrupt files or crash containers.

Improper authorization and insufficient argument validation in the Cisco NDFC REST API and web UI let an authenticated, low-privileged attacker execute arbitrary commands on …

Missing input validation in the BitBake Toaster server (Yocto Project) lets a remote, unauthenticated attacker execute arbitrary OS commands via a crafted HTTP request.