8943 matches found
CVE-2025-27614 Gitk allows arbitrary command execution
Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script e.g., Bourne shell, Perl, Python, ... supplied by the attacker by invoking...
CVE-2025-27614 Gitk allows arbitrary command execution
Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script e.g., Bourne shell, Perl, Python, ... supplied by the attacker by invoking...
OS Command Injection
mcp-remote is vulnerable to OS command injection. The vulnerability is due to crafted input from the authorizationendpoint response URL when connecting to untrusted MCP servers, which allows an attacker to execute arbitrary operating system commands...
CVE-2025-47812
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service root or SYSTEM by default. This is thu...
PT-2025-29143 · Unknown · Serviio Media Server
Name of the Vulnerable Software and Affected Versions: Serviio Media Server versions 1.4 through 1.8 Description: An unauthenticated command injection exists in Serviio Media Server. The /rest/action API endpoint, exposed by the console component default port 23423, is vulnerable. The...
CVE-2025-48501
An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commands may be executed on the server where the product is running...
Sudo chroot 1.9.17 - Local Privilege Escalation
Exploit Title: Sudo chroot 1.9.17 - Local Privilege Escalation Google Dork: not aplicable Date: Mon, 30 Jun 2025 Exploit Author: Stratascale Vendor Homepage:https://salsa.debian.org/sudo-team/sudo Software Link: Version: Sudo versions 1.9.14 to 1.9.17 inclusive Tested on: Kali Rolling 2025-7-3 CV...
Adobe ColdFusion 操作系统命令注入漏洞
Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion operating system command injection vulnerability, the vulnerability stems from the...
The vulnerability of the ExternalScripts web interface module of the NSClient++ monitoring tool allows a hacker to increase their privileges and execute arbitrary commands.
The vulnerability of the ExternalScripts web interface of the NSClient++ monitoring tool is related to the lack of authentication for the critical function. Exploiting this vulnerability allows a remote attacker to enhance their privileges and execute arbitrary commands by connecting to port 8443...
Belkin F9K1122 安全漏洞
The Belkin F9K1122 is a WiFi signal extender from Belkin Canada. The Belkin F9K1122 suffers from a command injection vulnerability that originates from a misbehavior of the parameters mwanipaddr/mwannetmask/mwangateway/mwanstaticdns1/mwanstaticdns2 in the file /goform/formSetWanStatic. can be...
FileBrowser Command Injection Vulnerability (CNVD-2025-22700)
FileBrowser is an open source web file browser . Provides a file management interface in a specified directory , can be used to upload , delete , preview , rename and edit your files . FileBrowser has a command injection vulnerability that can be exploited by an attacker to execute arbitrary...
FileBrowser Command Injection Vulnerability (CNVD-2025-22706)
FileBrowser is an open source web file browser . Provides a file management interface in a specified directory , can be used to upload , delete , preview , rename and edit your files . FileBrowser suffers from a command injection vulnerability, which is caused by a flaw in the command execution...
CVE-2025-34079
An authenticated remote code execution vulnerability exists in NSClient++ version 0.5.2.35 when the web interface and ExternalScripts module are enabled. A remote attacker with the administrator password can authenticate to the web interface default port 8443, inject arbitrary commands as externa...
CVE-2025-34078 NSClient++ 0.5.2.35 Local Privilege Escalation via ExternalScripts and Web Interface
A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file nsclient.ini stores the administrative password in plaintext and is readable by local users. By extracting this password, an attack...
CVE-2025-26074
Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes...
The vulnerability of the formWlSiteSurvey() function in TOTOLINK A702R router microprogramming software allows a intruder to execute arbitrary commands.
The vulnerability of the formWlSiteSurvey function in TOTOLINK A702R router microprogramming software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
Cisco Spaces Connector 操作系统命令注入漏洞
Cisco Spaces Connector is a system for integrating different devices from Cisco USA. An operating system command injection vulnerability exists in Cisco Spaces Connector that stems from insufficient restrictions on the execution of specific CLI commands, which could lead to elevation of privilege...
PT-2025-27655 · Cisco · Cisco Spaces Connector
Name of the Vulnerable Software and Affected Versions: Cisco Spaces Connector affected versions not specified Description: A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system...
CVE-2025-34056
An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly embedded into system commands without...
