CVE-2025-34149 Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via WPA2 Key

A command injection vulnerability affects the Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02 during WPA2 configuration. The 'key' parameter is interpreted directly by the system shell, enabling attackers to execute arbitrary commands as root. Exploitation requires no authentication and c...

CVE-2025-50688

A command injection vulnerability exists in TwistedWeb version 14.0.0 due to improper input sanitization in the file upload functionality. An attacker can exploit this vulnerability by sending a specially crafted HTTP PUT request to upload a malicious file e.g., a reverse shell script. Once...

PT-2025-32274 · Aitemi · Aitemi M300 Wi-Fi Repeater

Name of the Vulnerable Software and Affected Versions: Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02 affected versions not specified Description: A command injection vulnerability exists during WPA2 configuration. The key parameter is directly interpreted by the system shell, allowing...

Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

...

SUSE CVE-2025-52903

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions on the 2.x branch prior to 2.33.10, the Command Execution feature of File Browser only allows the execution of shell command which have be...

Tigo Energy Cloud Connect Advanced 命令注入漏洞

The Tigo Energy Cloud Connect Advanced is a compact data logger from Tigo Energy USA. Tigo Energy Cloud Connect Advanced suffers from a command injection vulnerability due to a flaw in the /cgi-bin/mobileapi endpoint when the DEVICEPING command is invoked. An attacker could exploit the...

CVE-2025-43979

The FIRSTNUM JC21A-04 router (versions through 2.01ME/FN ) is vulnerable to an OS command injection flaw. An authenticated attacker can execute arbitrary OS system commands with root privileges by sending crafted payloads to the xml_action.cgi?method= endpoint. To mitigate this risk, it is recomm...

Dell Unity 操作系统命令注入漏洞

Dell Unity is a mid-range hybrid flash storage platform from Dell that supports a wide range of workloads, including files and data blocks, and offers flexible deployment options and modern management capabilities. Dell Unity suffers from an operating system command injection vulnerability that c...

CVE-2025-54133

CVE-2025-54133 affects Cursor (code editor with AI features). The vulnerability lies in the MCP (Model Context Protocol) deeplink handler, where clicking a malicious cursor://anysphere.cursor-deeplink/mcp/install link can lead to execution of a full system command without showing the arguments in...

CVE-2025-52361

Insecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0.16 Build 2023-03-13 allows a locally authenticated low-privilege user to execute arbitrary commands with root privilege via editing this script which is executed with root-privileges on any interaction...

PT-2025-31701 · Cursor · Cursor

Name of the Vulnerable Software and Affected Versions: Cursor versions 1.17 through 1.2 Description: Cursor is a code editor built for programming with AI. A UI information disclosure exists in Cursor's MCP Model Context Protocol deeplink handler, enabling attackers to execute arbitrary system...

CVE-2025-52361

The AK-Nord USB-Server-LXL firmware (versions up to v0.0.16 Build 2023-03-13 ) contains a local privilege escalation vulnerability due to insecure permissions on the /etc/init.d/lighttpd script. A locally authenticated user with low privileges (such as the "admin" user) can modify this script bec...

OS Command Injection

bun is vulnerable to OS Command Injection. The vulnerability is due to the failure to neutralize special characters in the $ shell API, allowing attackers to execute arbitrary commands through crafted input...

MB connect line mbNET 安全漏洞

MB Connect Line mbNET is an industrial router from MB Connect Line, Germany. A security vulnerability exists in MB connect line mbNET HW1 and mbNET/mbNET.rokey, which stems from an undocumented method of bypassing the LUA sandbox and could lead to the execution of arbitrary OS commands...

CVE-2025-46811

A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x8664/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image...

CVE-2025-46811 SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint

A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x8664/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image...

CVE-2025-46811

CVE-2025-46811 is a Missing Authorization vulnerability in SUSE Manager allowing unauthenticated websocket access on port 443 to execute commands as root on any client. Affected are SUSE Manager Container (suse/manager/5.0/x86_64/server:5.0.5.7.30.1) before 5.0.27-150600.3.33.1 and various SUSE M...

PAN-OS Command Injection

The vulnerability of the PAN-OS operating system is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a perpetrator to execute arbitrary commands with root privileges...

CVE-2025-52284

Totolink X6000R V9.4.0cu.1360B20241207 was found to contain a command injection vulnerability in the sub4184C0 function via the tz parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request...

CVE-2025-52284

The Totolink X6000R wireless router, specifically running version V9.4.0cu.1360_B20241207 , is susceptible to a command injection vulnerability within the sub_4184C0 function. The root cause is a failure to strictly filter or sanitize the tz parameter, allowing unauthenticated remote attackers to...