Piotr Bazydło

Improper neutralization of special elements used in a command allows an unauthorized attacker to execute arbitrary code over a network, which can affect the system. This is known as command injection, where an attacker can inject malicious commands into a system through a vulnerable input.

An authenticated attacker with low privileges can execute arbitrary code over the network due to the deserialization of untrusted data. Deserialization is the process of converting a data stream back into an object, which, when handled insecurely, can lead to remote code execution.

External control of a file name or path allows an authorized attacker to execute arbitrary code over a network, which can affect the system.

Improper input validation in Microsoft Office SharePoint can allow an unauthorized attacker to execute code locally.