The vulnerability of the ArcGIS Server server, related to the lack of measures taken to protect the SQL query structure, allows attackers to execute arbitrary SQL commands.

The vulnerability of the ArcGIS Server server is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...

PT-2025-44218

Name of the Vulnerable Software and Affected Versions FastMCP versions prior to 2.13.0 Description FastMCP, a framework for building MCP applications, contains a command-injection issue. An attacker who can control the server name field of an MCP can execute arbitrary OS commands on Windows hosts...

CVE-2016-15048

AMTT Hotel Broadband Operation System HiBOS contains an unauthenticated command injection vulnerability in the /manager/radius/serverping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An...

PT-2025-43545

Name of the Vulnerable Software and Affected Versions Arista NG Firewall affected versions not specified Description This issue is a diagnostics command injection that could lead to arbitrary command execution with root privileges. Successful exploitation allows an attacker to execute commands...

Security Updates for Microsoft Visio Products C2R (October 2025)

The Microsoft Visio Products are missing a security update. It is, therefore, affected by a remote code execution vulnerability that attackers can exploit to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for this issue but has instead relied on...

EUVD-2016-10793

AMTT Hotel Broadband Operation System HiBOS contains an unauthenticated command injection vulnerability in the /manager/radius/serverping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An...

CVE-2016-15048 AMTT HiBOS Command Injection RCE via server_ping.php

AMTT Hotel Broadband Operation System HiBOS contains an unauthenticated command injection vulnerability in the /manager/radius/serverping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An...

PT-2025-43145

Name of the Vulnerable Software and Affected Versions AMTT Hotel Broadband Operation System HiBOS affected versions not specified Description The software contains an unauthenticated command injection issue in the /manager/radius/server ping.php endpoint. The application builds a shell command...

Unspecified Vulnerability in Palo Alto Networks PAN-OS (CNVD-2025-24729)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. A security vulnerability exists in Palo Alto Networks PAN-OS, which can be exploited by an attacker to cause a privileged administrator to bypass system restrictions and execute arbitrary...

PT-2025-42860

Name of the Vulnerable Software and Affected Versions Mediawiki Foundation - Springboard Extension affected versions not specified Description A flaw exists in the Mediawiki Foundation - Springboard Extension that allows for command injection due to improper neutralization of special elements use...

EUVD-2025-35078

Reolink Video Doorbell WiFi DB566128M5MPW allows root shell access through an unsecured UART/serial console. An attacker with physical access can connect to the exposed interface and execute arbitrary commands with root privileges...

CVE-2025-60856

Reolink Video Doorbell WiFi DB566128M5MPW allows root shell access through an unsecured UART/serial console. An attacker with physical access can connect to the exposed interface and execute arbitrary commands with root privileges. NOTE: this is disputed by the Supplier because of "certain...

CVE-2025-31342 Galaxy Software Services Vitals ESP Forum Module - Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals ESP Forum Module through 1.3 version allows remote authenticated users to execute arbitrary system commands via a malicious file...

CVE-2025-60856: Missing Authentication for Critical Function

Reolink Video Doorbell WiFi DB566128M5MPW allows root shell access through an unsecured UART/serial console. An attacker with physical access can connect to the exposed interface and execute arbitrary commands with root privileges. NOTE: this is disputed by the Supplier because of "certain...

VulnCheck KEV: CVE-2015-2280

snwrite.cgi in AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera with firmware FWAIC1620W1.1.0-1220120709r1192.pck allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the mac parameter...

CVE-2023-28815: Improper Neutralization of Parameter/Argument Delimiters

Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerability. Attackers may exploit this to gain platform privileges and execute arbitrary commands on the system.iSecure Center is software released for China's domest...

PT-2025-42596

Name of the Vulnerable Software and Affected Versions Hikvision iSecure Center affected versions not specified Description The software contains insufficient parameter validation, leading to a command injection issue. Attackers may be able to gain platform privileges and execute arbitrary command...

CVE-2025-34514

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and...

PT-2025-42502

Name of the Vulnerable Software and Affected Versions Ilevia EVE X1 Server firmware versions through 4.7.18.0.eden Description The software contains authenticated OS command injection flaws in several web-accessible PHP scripts. These scripts utilize the exec function, enabling a verified attacke...

CVE-2025-34514: Improper Neutralization of Special Elements used in an OS Command

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and...