CVE-2025-12472

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for...

pgAdmin 4 Command Injection

The vulnerability of the pgAdmin 4 database management tool exists because measures are not taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using specially created paths to files...

TVT NVMS-9000 security vulnerability

The TVT NVMS-9000 is a digital video recorder from China-based Tongwei TVT. A security vulnerability exists in the TVT NVMS-9000 prior to version 1.3.4, which stems from an OS command injection flaw in the inclusion of hardcoded API credentials and configuration services, which could lead to...

CVE-2025-12121

The Lite XL text editor (versions 2.1.8 and prior ) is vulnerable to arbitrary command execution due to a flaw in the system.exec function. The root cause is insufficient validation and unsanitized construction of shell commands. This vulnerability can be triggered through several features: proje...

CVE-2025-12121 CVE-2025-12121

Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching core.lua, drag-and-drop file handling rootview.lua, and the “open i...

CVE-2025-12121 CVE-2025-12121

Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching core.lua, drag-and-drop file handling rootview.lua, and the “open i...

CVE-2025-12121

Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching core.lua, drag-and-drop file handling rootview.lua, and the “open i...

TencentOS Server 3: emacs (TSSA-2023:0098)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0098 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2025-12472

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for...

CVE-2025-12472: Concurrent Execution using Shared Resource with Improper Synchronization

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for...

CVE-2025-34329: Unrestricted Upload of File with Dangerous Type

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodesfiles/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates t...

CVE-2025-34334: Improper Neutralization of Special Elements used in an OS Command

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax test functionality implemented by AudioCodesfiles/TestFax.php. When a fax "send" test is requested, the application builds a faxsender comman...

VulnCheck KEV: CVE-2024-12912

An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. Refer to the '01/02/2025 ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information...

Google Cloud Looker security vulnerabilities

Google Cloud Looker is an online tool from Google USA for transforming data into customizable and informative reports and dashboards. A security vulnerability exists in Google Cloud Looker that stems from the Looker Developer role that can manipulate LookML projects to take advantage of competing...

CVE-2025-63227: Unrestricted Upload of File with Dangerous Type

The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unrestricted file upload vulnerability in the /patch.php endpoint. An attacker with administrative credentials can upload arbitrary files e.g., PHP webshells, which are stored in the /patch/ directory. This...

HPE Aruba Networking 100 Series Cellular Bridge security vulnerabilities

The HPE Aruba Networking 100 Series Cellular Bridge is a 5G/4G mobile network wireless bridge device from HPE America. A security vulnerability exists in the HPE Aruba Networking 100 Series Cellular Bridge that stems from a command injection vulnerability in the command line interface that could...

interactive-git-checkout exec Command Execution

The vulnerability of the exec function in the interactive-git-checkout command-line utility is related to insufficient input validation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

Pandora FMS Arbitrary Command Execution

The vulnerability of the Pandora FMS system for monitoring and managing IT environments stems from the lack of measures taken at the management level to secure data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands and inject arbitrary OS commands...

Spectrum Power 4 Privilege Escalation Command Injection

The vulnerability of the Spectrum Power 4 software is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary commands...

TrueConf Server Command Execution DoS

The vulnerability of the TrueConf Server software is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely and cause service failures...