graphrealtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called excludeip). This excludeip value is passed to the exec function in the discoverieshelper.php file (inside the alliplist function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.