CVE-2025-23056: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the...

CVE-2025-23057: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the...

LibreNMS Authenticated Remote Code Execution

An authenticated attacker can create dangerous directory names on the system and alter sensitive configuration parameters through the web portal. Those two defects combined then allows to inject arbitrary OS commands inside shellexec calls, thus achieving arbitrary code execution. This module...

CVE-2025-23051

CVE-2025-23051 affects ArubaOS (AOS-8 through AOS-10) — a web-based management interface vulnerability allows an authenticated user to perform parameter injection to overwrite arbitrary system files. Root cause: parameter injection in the authenticated context. Impact: potential compromise of sys...

CVE-2024-50566

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiManager Cloud 7.6.0 through 7.6.1, FortiManager Cloud 7.4.0 through 7.4.4, FortiManager Cloud 7.2.2 through 7.2.7, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.0 through...

CVE-2024-50566

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiManager Cloud 7.6.0 through 7.6.1, FortiManager Cloud 7.4.0 through 7.4.4, FortiManager Cloud 7.2.2 through 7.2.7, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.0 through...

Siemens SIPROTEC 5 安全漏洞

SIPROTEC 5 devices provide a range of integrated protection, control, measurement and automation functions for substations and other applications. A File Access Improperly Restricted vulnerability exists in Siemens SIPROTEC 5. The vulnerability, which arises from the device not properly restricti...

Siemens SIPROTEC 5 Improper File Access Restriction Vulnerability

SIPROTEC 5 devices provide a range of integrated protection, control, measurement and automation functions for substations and other applications. A File Access Improperly Restricted vulnerability exists in Siemens SIPROTEC 5. The vulnerability, which arises from the device not properly restricti...

Unspecified Vulnerability in SonicWall SonicOS (CNVD-2025-01663)

SonicWALL SonicOS is a set of operating systems designed for SonicWall firewall appliances from SonicWALL, Inc. A security vulnerability exists in SonicWALL SonicOS, which stems from a post-authentication absolute path traversal vulnerability that can be exploited by an authenticated remote...

SonicWALL SonicOS 安全漏洞

SonicWALL SonicOS is a set of operating systems designed for SonicWall firewall appliances from SonicWALL, Inc. A security vulnerability exists in SonicWALL SonicOS, which stems from a format string issue that can be exploited by an authenticated, remote attacker to crash the firewall and...

Cisco Crosswork Network Controller Stored Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Crosswork Network Controller could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against users of the interface of an affected system. These vulnerabilities exist because the web-based...

PT-2025-1022 · Cisco · Cisco Common Services Platform Collector

Name of the Vulnerable Software and Affected Versions: Cisco Common Services Platform Collector CSPC affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to...

PT-2025-1020 · Cisco · Cisco Crosswork Network Controller

Name of the Vulnerable Software and Affected Versions: Cisco Crosswork Network Controller affected versions not specified Description: The vulnerability exists in the web-based management interface of Cisco Crosswork Network Controller due to improper validation of user-supplied input. An...

CVE-2025-20166: Improper Neutralization of Invalid Characters in Identifiers in Web Pages

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied...

CVE-2024-54006

Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute arbitrary commands as a privileged...

CVE-2024-54006 Authenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client Bridge

Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute arbitrary commands as a privileged...

Hewlett Packard Enterprise 501 Wireless Client Bridge 命令注入漏洞

The Hewlett Packard Enterprise 501 Wireless Client Bridge HPE 501 Wireless Client Bridge is a wireless client bridge from Hewlett Packard Enterprise, USA. A security vulnerability exists in the Hewlett Packard Enterprise 501 Wireless Client Bridge that stems from multiple command injection...

PT-2025-1004 · Unknown · 501 Wireless Client Bridge

Name of the Vulnerable Software and Affected Versions: 501 Wireless Client Bridge affected versions not specified Description: The issue concerns multiple command injection vulnerabilities in the web interface of the 501 Wireless Client Bridge. These vulnerabilities could lead to authenticated...

Hewlett Packard Enterprise 501 Wireless Client Bridge 命令注入漏洞

The Hewlett Packard Enterprise 501 Wireless Client Bridge HPE 501 Wireless Client Bridge is a wireless client bridge from Hewlett Packard Enterprise, USA. A security vulnerability exists in the Hewlett Packard Enterprise 501 Wireless Client Bridge that stems from multiple command injection...

Webmin 操作系统命令注入漏洞

Webmin is a set of Web-based system administration tools for use in Unix-like operating systems from the Webmin community. Webmin suffers from an operating system command injection vulnerability that stems from a lack of proper validation of user-supplied strings before executing system calls,...