CVE Watch7 de out. de 2026

CVE-2025-5965

In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization

CVSS

7.2

Alta

EPSS

28.2%

p98

KEV

—

Exploit Today

0-100

Publicado: 5 de jan. de 2026 · Última mod.: 7 de out. de 2026 · CWE-78

EPSS · 30d

28.2%EPSS · 30 dias28.2%

2026-10-122026-11-10

Descrição técnica

In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Backup configuration in the administration setup modules) allows OS Command Injection.This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1229888.0 ALT

—

——0Improper authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.3h CVE-2026-1199067.8 ALT

—

——0Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an authorized attacker to elevate privileges locally.3h CVE-2026-1094578.0 ALT

—

——0Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.3h CVE-2026-1022248.4 ALT

—

——0Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.3h CVE-2026-1260427.0 ALT

—

——0VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.5h CVE-2026-1054257.2 ALT

—

——0OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.4h