Virgil CGI Scanner by Mark Ruef has a vulnerability where user input is trusted without being sanitized and is actually populating bash variables which end up getting executed. Simple exploit examples are included.
d904fe4eeff1617f799ad5d492b310acc2605145158faff2c8c8a7b7a546cdac