18151 matches found
GPT-SoVITS-WebUI open_slice function command injection vulnerability
GPT-SoVITS-WebUI is a TTS training model. A command injection vulnerability exists in the GPT-SoVITS-WebUI openslice function, which can be exploited by an attacker to execute arbitrary commands on the system...
CVE-2025-46117
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where a hidden debug script .apdebug.sh invoked from the restricted CLI does not properly sanitize its input, allowing an authenticated attacker to...
CVE-2025-26855
A SQL injection in Articles Calendar extension 1.0.0 - 1.0.1.0007 for Joomla allows attackers to execute arbitrary SQL commands...
CVE-2025-52046
Totolink A3300R V17.0.0cu.596B20250515 was found to contain a command injection vulnerability in the sub4197C0 function via the mac and desc parameters. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request...
CVE-2025-54073
CVE-2025-54073 affects the mcp-package-docs MCP Server. The issue is a command-injection vulnerability caused by unsanitized input used in child_process.exec, enabling shell metacharacter injection and potential remote code execution under the server process’s privileges. A fix was committed in c...
CVE-2025-26855 Extension - joomcar.net - SQL injection in Articles Calendar 1.0.0 - 1.0.1.0007 for Joomla
A SQL injection in Articles Calendar extension 1.0.0 - 1.0.1.0007 for Joomla allows attackers to execute arbitrary SQL commands...
CVE-2025-52046
Totolink A3300R V17.0.0cu.596B20250515 was found to contain a command injection vulnerability in the sub4197C0 function via the mac and desc parameters. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request...
PT-2025-29926 · Totolink · Totolink A3300R
Name of the Vulnerable Software and Affected Versions: Totolink A3300R version V17.0.0cu.596 B20250515 Description: Totolink A3300R V17.0.0cu.596 B20250515 contains a command injection vulnerability in the sub 4197C0 function. This allows unauthenticated attackers to execute arbitrary commands vi...
CVE-2025-52046
Totolink A3300R V17.0.0cu.596B20250515 was found to contain a command injection vulnerability in the sub4197C0 function via the mac and desc parameters. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request...
EUVD-2025-21783
Totolink A3300R V17.0.0cu.596B20250515 was found to contain a command injection vulnerability in the sub4197C0 function via the mac and desc parameters. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request...
CVE-2025-52046
Totolink A3300R with firmware V17.0.0cu.596_B20250515 contains a command-injection flaw in the sub_4197C0 function, exploitable via mac and desc parameters by unauthenticated users. The impact is arbitrary command execution with high severity; no fix information is provided in the connected sourc...
CVE-2025-20274 Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management...
CVE-2025-52690
CVE-2025-52690 describes a command injection vulnerability in the OmniAccess Stellar over UDP service. The available documents consistently indicate that exploitation could allow an attacker to execute arbitrary commands with root privileges, potentially compromising confidentiality, integrity, a...
CVE-2025-53905 Vim has path traversial issue with tar.vim and special crafted tar files
Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successful...
The vulnerability of the “Tekon” SCADA system, related to the lack of authentication for critical functions, allows attackers to execute arbitrary codes and increase their privileges.
The vulnerability of the “Tekon” SCADA system is related to the lack of authentication for critical functions. Exploiting this vulnerability allows an intruder to execute arbitrary commands and increase their privileges...
TOTOLINK N300RB 8.54 Hidden Remote Support Feature
A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges...
CVE-2025-53623
The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vulnerability in the CsvEnumerator class. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system wher...
CVE-2025-50756
Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsysadm function via the newpass parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...
CVE-2025-50756
Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsysadm function via the newpass parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...