Authenticated administrative command execution via absolute-path blacklist bypass

Command injection in ManageEngine Applications Manager 178100 and earlier allows remote authenticated users to execute administrative commands. The Execute Program action checks command names against a blacklist but accepts absolute paths to prohibited commands, bypassing that validation. A low-privileged application account can reach the action, and successful exploitation runs sensitive commands with the server's administrative privileges.