32395 matches found
PT-2025-50533
PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands...
PT-2025-50532
WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary syst...
PT-2025-50358
Name of the Vulnerable Software and Affected Versions Jenkins Git client Plugin versions 6.4.0 and earlier Description The Jenkins Git client Plugin does not properly escape the path to the workspace directory when creating a temporary shell script. This allows attackers who can control the...
PT-2025-50531
Name of the Vulnerable Software and Affected Versions Serendipity version 2.5.0 Description An authenticated administrator can upload malicious PHP files through the media upload functionality, leading to remote code execution. An attacker can create a PHP shell with a command execution form,...
📄 Zimbra Collaboration Suite Postjournal 10.1.0 Remote Code Execution
Proof of concept for a critical vulnerability exists in the Zimbra Collaboration Suite ZCS PostJournal service that allows attackers to execute arbitrary system commands without authentication. Version 10.1.0 is affected...
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool
Summary A command injection vulnerability is present in the function tool runsshcommandwithcredentials available to AI agents. Details This is the source code of the function tool runsshcommandwithcredentials code: python @functiontool def runsshcommandwithcredentials host: str, username: str,...
CVE-2021-47728
Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell commands. Attackers can exploit the 'addr' and 'port' parameters to inject commands and gain www-data user access through chained local...
CVE-2025-8148
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key...
EUVD-2024-55307
A vulnerability has been identified in RUGGEDCOM ROX II family All versions V2.17.0. Due to the insufficient validation during the installation and load of certain configuration files of the affected device, an attacker could spawn a reverse shell and gain root access on the affected system...
EUVD-2024-55308
A vulnerability has been identified in RUGGEDCOM ROX II family All versions V2.17.0. During the Dynamic DNS configuration of the affected product it is possible to inject additional configuration parameters. Under certain circumstances, an attacker could leverage this vulnerability to spawn a...
EUVD-2024-55309
A vulnerability has been identified in RUGGEDCOM ROX II family All versions V2.17.0. The DHCP Server configuration file of the affected products is subject to code injection. An attacker could leverage this vulnerability to spawn a reverse shell and gain root access on the affected system...
CVE-2025-64661
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Shell allows an authorized attacker to elevate privileges locally...
CVE-2025-64661
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Shell allows an authorized attacker to elevate privileges locally...
CVE-2025-64658
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Shell allows an authorized attacker to elevate privileges locally...
CVE-2025-64658
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Shell allows an authorized attacker to elevate privileges locally...
CVE-2025-62565
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally...
CVE-2025-62565
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally...
CVE-2025-64661 Windows Shell Elevation of Privilege Vulnerability
...
CVE-2025-64661
CVE-2025-64661 – Windows Shell Elevation of Privilege is supported by connected sources. The vulnerability involves a race condition in concurrent execution using a shared resource in Windows Shell, allowing an authorized local attacker to elevate privileges. Connected documents confirm impact as...
