12694 matches found
go-gh security vulnerabilities
go-gh is a collection of Go modules open sourced from the GitHub CLI. It is used to interact with gh and GitHub APIs from the command line. A security vulnerability exists in go-gh versions prior to 2.12.1, which stems from an attacker-controlled GitHub Enterprise Server could lead to the executi...
PT-2025-23335
Name of the Vulnerable Software and Affected Versions go-gh versions prior to 2.12.1 Description A security issue has been identified where an attacker-controlled GitHub Enterprise Server could execute arbitrary commands on a user's machine. This is achieved by replacing HTTP URLs provided by...
CVE-2025-48938: Trust Boundary Violation
go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URL...
Linksys FGW3000-AH Wi-Fi Router Command Execution
The vulnerability of the controlpanelsw function in the /cgi-bin/sysconf.cgi script of the Linksys FGW3000-AH and FGW3000-HK Wi-Fi routers is related to incorrect elimination of special elements in the output data when processing the parameter filename. Exploiting this vulnerability allows an...
OS Command Injection
LLama-Index CLI is vulnerable to OS Command Injection. The vulnerability is due to improper input handling due to unsanitized use of the --files argument passed directly into os.system, allowing arbitrary command execution...
TOTOLINK CA600-PoE Router Arbitrary Command Execution
The vulnerability of the CloudSrvUserdataVersionCheck function in TOTOLINK CA600-PoE router’s software lies in the lack of measures taken at the control level during the processing of the svn parameter. Exploiting this vulnerability allows an attacker to execute arbitrary commands by sending...
CVE-2025-4009 Unauthenticated Arbitrary Command Injection in Evertz SDVN
The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among...
WAVLINK WL-WN579A3 /cgi-bin/firewall.cgi Command Injection Vulnerability
WAVLINK WL-WN579A3 is a high performance dual-band wireless card from China RuiYin WAVLINK. The WAVLINK WL-WN579A3 suffers from a command injection vulnerability that originates from unfiltered input in the /cgi-bin/firewall.cgi component, which can be exploited by an attacker to submit a special...
WAVLINK WL-WN579A3 /cgi-bin/adm.cgi Command Injection Vulnerability
WAVLINK WL-WN579A3 is a high performance dual-band wireless card from China RuiYin WAVLINK. A command injection vulnerability exists in WAVLINK WL-WN579A3 /cgi-bin/adm.cgi, which can be exploited by an attacker to submit a special request and execute arbitrary commands...
CVE-2025-41651: Missing Authentication for Critical Function
Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system compromise...
PT-2025-49561
Уязвимость функции setDeviceURL /goform/setDeviceURL микропрограммного обеспечения маршрутизаторов Linksys RE6500, RE6250, RE6300, RE6350, RE7000 и RE9000 связана с манипулированием аргументом DeviceURL. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить...
CVE-2025-0356
NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands via the network...
CVE-2024-52505
matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in...
CVE-2024-52019
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at geniefix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...
CVE-2024-49368
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue...
CVE-2024-7110
An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection...
CVE-2024-30928
SQL Injection vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary SQL commands via 'classids' Parameter in ajax/query.slide.next.inc...
CVE-2024-22722
Server Side Template Injection SSTI vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application...