CVE-2025-44880

The Wavlink WL-WN579A3 v1.0 dual-band wireless card is affected by a command injection vulnerability in the /cgi-bin/adm.cgi component. The root cause is the improper neutralization of special elements used in operating system commands, which allows a remote attacker to submit a crafted request a...

CVE-2025-44881

The Wavlink WL-WN579A3 v1.0 wireless card is susceptible to a command injection vulnerability within the /cgi-bin/qos.cgi component. The root cause is unfiltered input , which allows an attacker to execute arbitrary commands via a crafted request. Exploitation of this flaw could lead to a total t...

CVE-2025-44882

The Wavlink WL-WN579A3 v1.0 router is affected by a command injection vulnerability in the /cgi-bin/firewall.cgi component. The root cause is the failure to neutralize specific elements used in operating system commands, allowing an attacker to submit a special request with unfiltered input to ex...

TOTOLINK A3002R Command Injection Vulnerability

TOTOLINK A3002R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3002R suffers from a command injection vulnerability that stems from the FUN00459fdc function failing to properly filter constructed command special characters, commands, etc. The vulnerability can be...

CVE-2025-44882

A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input...

WAVLINK WL-WN579A3 has security vulnerabilities

WAVLINK WL-WN579A3 is a high performance dual-band wireless card from China RuiYin WAVLINK. The WAVLINK WL-WN579A3 suffers from a command injection vulnerability that originates from unfiltered input in the /cgi-bin/firewall.cgi component, which can be exploited by an attacker to submit a special...

CVE-2025-44880: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input...

CVE-2025-44882

A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input...

VMware vCenter Server security vulnerabilities

VMware vCenter Server is a suite of server and virtualization management software from VMware. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructures. A security vulnerability exists in VMware...

CVE-2025-44881

A command injection vulnerability in the component /cgi-bin/qos.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input...

CVE-2025-44880

A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input...

Cisco Application Policy Infrastructure Controller Privilege Escalation Command Injection

The vulnerability of the Command Line Interface CLI of the Cisco Application Policy Infrastructure Controller management tool is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute...

Tenda RX2 Pro Router Arbitrary Command Execution

The vulnerability of the Tenda RX2 Pro router’s microprogrammed management service is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending specially crafted UDP packets...

CVE-2025-32002

The CVE-2025-32002 issue affects I-O DATA HDL-T Series network attached storage with firmware 1.21 and earlier, where enabling the Remote Link3 function allows an unauthenticated remote attacker to execute arbitrary OS commands due to improper neutralization of OS command elements. Documented imp...

CVE-2025-46052

An error-based SQL Injection SQLi vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a crafted payload into the DEL form field in a POST request to /StockCounts.php...

I-O Data HDL-T: Operating System Command Injection Vulnerability

I-O Data HDL-T is a series of network hard disks from I-O Data Japan. An operating system command injection vulnerability exists in I-O Data HDL-T versions 1.21 and earlier, which stems from OS command injection and could lead to the execution of arbitrary OS commands...

Arbitrary Command Injection

Craft CMS is vulnerable to Arbitrary Command Injection. The vulnerability is due to unauthenticated user-supplied data being stored in session files without validation, potentially allowing PHP code injection into a predictable server file path...

Tenda AC9 formsetUsbUnload Function Command Injection Vulnerability

Tenda AC9 is a wireless router from Tenda, a Chinese company. Tenda AC9 suffers from a command injection vulnerability, which arises from the deviceName parameter of the formsetUsbUnload function failing to correctly filter constructed command special characters, commands, etc. The vulnerability...

D-Link DIR-890L/DIR-806A1 Command Injection Vulnerability

D-Link DIR-890L and D-Link DIR-806A1 are both products of China's AUO D-Link.D-Link DIR-890L is a wireless router.D-Link DIR-806A1 is a dual-band wireless router that supports AC750 wireless rate and USB sharing function. The D-Link DIR-890L and D-Link DIR-806A1 suffer from a command injection...

NETGEAR RAX5 vif_enable function command injection vulnerability

The NETGEAR RAX5 is a wireless router from NETGEAR. NETGEAR RAX5 suffers from a command injection vulnerability that originates from the iface parameter in the vifenable function failing to correctly filter constructed command special characters, commands, and so on. An attacker can exploit this...