webglimpse.cgi in Webglimpse before 2.20.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter, as exploited in the wild in March 2012.
http://www.securitytracker.com/id?1026825
http://www.kb.cert.org/vuls/id/364363