CVE-2025-20274 Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management...

CVE-2025-52690

CVE-2025-52690 describes a command injection vulnerability in the OmniAccess Stellar over UDP service. The available documents consistently indicate that exploitation could allow an attacker to execute arbitrary commands with root privileges, potentially compromising confidentiality, integrity, a...

CVE-2025-53905 Vim has path traversial issue with tar.vim and special crafted tar files

Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successful...

Tekon SCADA Auth Bypass Privilege Escalation

The vulnerability of the “Tekon” SCADA system is related to the lack of authentication for critical functions. Exploiting this vulnerability allows an intruder to execute arbitrary commands and increase their privileges...

TOTOLINK N300RB 8.54 Hidden Remote Support Feature

A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges...

CVE-2025-53623

The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vulnerability in the CsvEnumerator class. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system wher...

CVE-2025-50756

Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsysadm function via the newpass parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-50756

Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsysadm function via the newpass parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-50756: Improper Neutralization of Special Elements used in a Command

Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsysadm function via the newpass parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-52089

A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges...

Websoft HCM Automation Software Command Injection

The vulnerability of Websoft HCM’s automation software for HR processes is related to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by invoking methods from th...

Command Injection

mcp-server-kubernetes is vulnerable to Command Injection. The vulnerability is due to unsanitized command execution due to direct use of unvalidated user input in childprocess.execSync, allowing injection of shell metacharacters and execution of arbitrary system commands...

Microsoft Office 2016 Multiple Vulnerabilities (KB5002742)

This host is missing an critical security update according to Microsoft KB5002742 SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

HPE Networking Instant On Access Points 安全漏洞

HPE Networking Instant On Access Points is a wireless network access point from HPE America. A security vulnerability exists in HPE Networking Instant On Access Points that stems from the presence of authenticated command injection in the command line interface, which could lead to the execution ...

CVE-2025-20308

A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. This vulnerability is due to insufficient restrictions during the execution of specific CLI commands. An attacker...

Simple Pizza Ordering System /addpro.php File SQL Injection Vulnerability

Simple Pizza Ordering System is a simple pizza ordering system. Simple Pizza Ordering System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter ID of the file /addpro.php. An attacker can exploit this vulnerability...

OAM Service Arbitrary Command Execution

The vulnerability of the OAM service of the Nokia Single RAN network management platform lies in the lack of measures taken to clean data at the management level during the processing of the COMAconfig.xml file. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

File Web Manager Arbitrary Command Execution

The vulnerability of the web manager responsible for managing files and directories in File Browser is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary commands...

CVE-2025-45809

SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints...

CVE-2025-45809: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints...