Chain: improper input validation (CWE-20) in username parameter, leading to OS command injection (CWE-78), as exploited in the wild per CISA KEV.
CVE-2022-1509
injection of sed script syntax ("sed injection")
CVE-2021-41282