Roxy-WI up to and including 5.2.2.0 allows command injection via /app/funct.py and /api/api_funct.py.
roxy-wi roxy-wi