CVE-2025-44864: Improper Neutralization of Special Elements used in a Command

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44863: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44860: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44847: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44866

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

TOTOLINK CA300-PoE security vulnerability

TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. TOTOLINK CA300-PoE suffers from a command injection vulnerability that stems from the msgprocess function Url parameter failing to correctly filter constructive command special characters, commands, etc., which...

TOTOLINK CA300-PoE security vulnerability

TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. The TOTOLINK CA300-PoE suffers from a command injection vulnerability that stems from the failure of the msgprocess function Port parameter to correctly filter constructed command special characters, commands,...

CVE-2025-44838

The TOTOLINK CPE CP900 (specifically firmware version V6.3c.1144_B20190715 ) is vulnerable to a command injection flaw within the setUploadUserData function. The root cause is a lack of proper input sanitization or filtering for special characters when processing the FileName parameter. This allo...

CVE-2025-44867

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44867

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44864

The Tenda W20E router, specifically version 15.11.0.6 , is susceptible to a command injection vulnerability in the formSetDebugCfg function. The root cause is the failure of the module parameter to properly filter constructor command special characters and other commands. This oversight allows an...

CVE-2025-44840

The TOTOLINK CA600-PoE outdoor wireless AP/CPE (specifically version V5.3c.6665_B20180820 ) is susceptible to a command injection vulnerability in the CloudSrvUserdataVersionCheck function. The flaw exists because the svn parameter fails to properly filter special characters and commands during p...

CVE-2025-44861

The TOTOLINK CA300-PoE wireless access point (firmware version V6.2c.884_B20180522 ) is susceptible to a command injection vulnerability within the CloudSrvUserdataVersionCheck function. The root cause is a lack of proper input validation and filtering for special characters within the url parame...

CVE-2025-24351

A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated low-privileged attacker to execute arbitrary OS commands in the context of user “root” via a crafted HTTP request...

CVE-2025-24351

The CVE-2025-24351 entry affects the ctrlX OS web application’s “Remote Logging” functionality. A remote authenticated (low-privileged) attacker can execute arbitrary OS commands in the context of user “root” via a crafted HTTP request. Reports consistently describe this as a root-level command e...

Amazon Linux AMI : ctags (ALAS-2025-1974)

The version of ctags installed on the remote host is prior to 5.8-2.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2025-1974 advisory. A flaw was found in Exuberant Ctags in the way it handles the -o option. This option specifies the tag filename. A crafted tag filenam...

Insecure Deserialization

LLaMA-Factory is vulnerable to Insecure Deserialization. The vulnerability is due to insecure deserialization causing because of the use of torch.load on untrusted .bin files, allowing arbitrary command execution during deserialization...

Important: ctags

Issue Overview: A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags in sort.c calls...

Arbitrary Command Injection

Overview aworld is an Ant Agent Package Affected versions of this package are vulnerable to Arbitrary Command Injection through the subprocess.run and subprocess.Popen functions in shelltool.py. This allows an attacker to inject malicious commands due to insufficient sanitization of user-supplied...

Planet UNI-NMS-Lite Trust Management Issues Vulnerability

Planet UNI-NMS-Lite is a universal network management system from PLANET China that monitors all deployed wired or wireless PoE industrial grade network devices. Planet UNI-NMS-Lite suffers from a trust management issue vulnerability that can be exploited by an attacker to submit a special reques...