SmartFabric OS10 Command Execution

The vulnerability of the SmartFabric OS10 network operating system is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

PYSEC-2025-116

A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands...

CVE-2024-55030: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands...

PT-2025-20016

Уязвимость межсетевого экрана UserGate Next-Generation Firewall NGFW и межсетевого экрана уровня веб-приложений UserGate Web Application Firewall WAF связана с непринятием мер по нейтрализации специальных элементов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно,...

TOTOLINK X5000R Router setWiFiScheduleCfg() Arbitrary Command Execution

The vulnerability of the setWiFiScheduleCfg function in the web/cgi-bin/cstecgi.cgi script of the TOTOLINK X5000R router’s microprogramming system is related to the failure to take measures to neutralize special elements used in the operating system’s processing of the week parameter. Exploiting...

TOTOLINK EX200 Router Arbitrary Command Execution

The vulnerability of the setUpgradeFW function in TOTOLINK EX200 router microprogramming software is related to the improper elimination of special elements during the processing of the FileName parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

TOTOLINK X5000R Router setWiFiScheduleCfg() Arbitrary Command Execution

The vulnerability of the setWiFiScheduleCfg function in the web/cgi-bin/cstecgi.cgi script of the TOTOLINK X5000R router’s microprogramming system is related to the failure to take measures to neutralize special elements used in the operating system’s processing of the eHour parameter. Exploiting...

CVE-2025-29310

An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerability allows attackers to execute arbitrary commands or access network information...

CVE-2025-29310

An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerability allows attackers to execute arbitrary commands or access network information...

CVE-2025-29310

The Linux Open Network Operating System (ONOS) version v2.7.0 is vulnerable to a packet deserialization issue (CWE-502). Attackers can exploit this by supplying a crafted LLDP packet , which may lead to the execution of arbitrary commands or unauthorized access to network information . While the ...

CVE-2025-29310

An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerability allows attackers to execute arbitrary commands or access network information...

CVE-2025-29310

An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerability allows attackers to execute arbitrary commands or access network information...

CVE-2025-29310: Deserialization of Untrusted Data

An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerability allows attackers to execute arbitrary commands or access network information...

PT-2025-12707 · Onos · Onos

Name of the Vulnerable Software and Affected Versions: onos version 2.7.0 Description: The issue allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet, enabling them to execute arbitrary commands or access network information. Recommendations: For onos...

CVE-2024-7045

In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt...

Arbitrary Command Injection

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Arbitrary Command Injection through the postcallrules configuration. An attacker can execute arbitrary commands by setting a system method, such as os.system, as a callback...

Arbitrary Command Injection

Overview lollms is a python library for AI personality definition Affected versions of this package are vulnerable to Arbitrary Command Injection in the calculate function, which uses the eval function without sufficient protection. An attacker can execute commands on the server by injecting...

CVE-2024-8156

A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input github.head.ref is used insecurely, allowing an attacker to inject arbitrary commands. This vulnerability affects versions up to and including the latest version...

CVE-2024-6825

CVE-2024-6825 affects litellm 1.40.12. The vulnerability lies in how the post_call_rules configuration is parsed: a callback can be set to a system method (for example os.system), with the final part treated as the function name and the rest imported as a Python module, enabling arbitrary command...

CVE-2025-25220

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in +F FS010M versions prior to V2.0.11101. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker...