EUVD-2025-23640

Malicious code in bioql PyPI...

EUVD-2024-34689

Malicious code in bioql PyPI...

ProFTPD Detection Consolidation

Consolidation of ProFTPD detections. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.155379";...

CVE-2025-9961 Authenticated RCE by CWMP binary

An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500. The exploit can only be conducted via a Man-In-The-Middle MITM attack. This issue affects AX10 V1/V1.2/V2/V2.6/V3/V3.6: before 1.2.1; AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6:...

PT-2025-36367

Name of the Vulnerable Software and Affected Versions TP-Link AX10 versions prior to 1.2.1 TP-Link AX1500 versions prior to 1.3.11 Description A flaw exists in the CWMP CWMP/TR-069 binary of TP-Link AX10 and AX1500 routers that could allow an authenticated attacker to remotely execute arbitrary...

CVE-2025-43984

An issue was discovered on KuWFi GC111 devices Hardware Version: CPE-LM321V3.2, Software Version: GC111-GL-LM321V3.020191211. They are vulnerable to unauthenticated /goform/goformsetcmdprocess requests. A crafted POST request, using the SSID parameter, allows remote attackers to execute arbitrary...

CVE-2025-43978

Jointelli 5G CPE 21H01 firmware JY21H01A3v1.36 devices allow blind OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=setWPSpin and /ubus/?flag=netAppStar1 and /ubus/?flag=setwificfgs. This allows an authenticated attacker to execute arbitrary OS commands with root...

CVE-2025-43978

Jointelli 5G CPE 21H01 firmware JY21H01A3v1.36 devices allow blind OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=setWPSpin and /ubus/?flag=netAppStar1 and /ubus/?flag=setwificfgs. This allows an authenticated attacker to execute arbitrary OS commands with root...

CVE-2025-43978

Jointelli 5G CPE 21H01 firmware JY21H01A3v1.36 devices allow blind OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=setWPSpin and /ubus/?flag=netAppStar1 and /ubus/?flag=setwificfgs. This allows an authenticated attacker to execute arbitrary OS commands with root...

PT-2025-31946

Name of the Vulnerable Software and Affected Versions Jointelli 5G CPE 21H01 firmware version 1.36 Description Jointelli 5G CPE 21H01 firmware version 1.36 contains a blind OS command injection issue. Multiple API endpoints are vulnerable, including /ubus/?flag=set WPS pin, /ubus/?flag=netAppStar...

CVE-2025-43978

The Jointelli 5G CPE 21H01 router, running firmware version JY_21H01_A3_v1.36 , is vulnerable to a (blind) OS command injection flaw. The issue resides in multiple API endpoints, specifically /ubus/?flag=set_WPS_pin, /ubus/?flag=netAppStar1, and /ubus/?flag=set_wifi_cfgs. An authenticated attacke...

CVE-2025-43978: Improper Neutralization of Special Elements used in an OS Command

Jointelli 5G CPE 21H01 firmware JY21H01A3v1.36 devices allow blind OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=setWPSpin and /ubus/?flag=netAppStar1 and /ubus/?flag=setwificfgs. This allows an authenticated attacker to execute arbitrary OS commands with root...

CVE-2025-43978

Jointelli 5G CPE 21H01 firmware JY21H01A3v1.36 devices allow blind OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=setWPSpin and /ubus/?flag=netAppStar1 and /ubus/?flag=setwificfgs. This allows an authenticated attacker to execute arbitrary OS commands with root...

CVE-2024-28729

An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to execute arbitrary code via a crafted request...

CVE-2024-48440

Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command injection vulnerability via the component atcommand.asp...

CVE-2024-53561

A remote code execution RCE vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary code via a crafted request...

CVE-2024-53563

A stored cross-site scripting XSS vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...

CVE-2024-48441

Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETSv3.2.468.11.04P4 was discovered to contain a command injection vulnerability via the component atcommand.asp...

CVE-2022-28491

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the hostname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-28494

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...