VulnCheck KEV: CVE-2022-1703

Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Commands which potentially leads to remote command execution vulnerability or denial of service DoS attack...

CVE-2025-54964

CVE-2025-54964 affects BAE Systems SOCET GXP prior to 4.6.0.2. The issue arises when a user can interact with the GXP Job Service, enabling injection of arbitrary executables. If the Job Service is configured for local-only access, this may allow privilege escalation; if it is network-accessible,...

Security Updates for Microsoft Word Products C2R (October 2025)

The Microsoft Word Products are missing security updates. It is, therefore, affected by multiple remote code execution vulnerabilities that attackers can exploit to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for these issues but has instead...

PT-2025-43551

Name of the Vulnerable Software and Affected Versions Veeder-Root TLS4B ATG versions affected versions not specified Description The TLS4B ATG system’s SOAP-based interface is susceptible to command injection due to its accessibility through the web services handler. This allows remote attackers...

CVE-2024-58274

Hikvision CSMP Comprehensive Security Management Platform iSecure Center through 2024-08-01 allows execution of a command within $ in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025...

CVE-2025-6542

An arbitrary OS command may be executed on the product by a remote unauthenticated attacker...

CVE-2025-6541

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface...

CVE-2024-58274

CVE-2024-58274 affects Hikvision CSMP iSecure Center (through 2024-08-01). Affected component is the JSON data handling in /center/api/installation/detection, where unverified use of the $() command can lead to arbitrary command execution. Documents indicate exploitation in the wild during 2024 a...

VulnCheck KEV: CVE-2016-15048

AMTT Hotel Broadband Operation System HiBOS contains an unauthenticated command injection vulnerability in the /manager/radius/serverping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An...

VulnCheck KEV: CVE-2024-58274

Hikvision CSMP Comprehensive Security Management Platform iSecure Center through 2024-08-01 allows execution of a command within $ in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025...

EUVD-2024-55040

Hikvision CSMP Comprehensive Security Management Platform iSecure Center through 2024-08-01 allows execution of a command within $ in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025...

CVE-2024-58274

Hikvision CSMP Comprehensive Security Management Platform iSecure Center through 2024-08-01 allows execution of a command within $ in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025...

VulnCheck KEV: CVE-2025-6264

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...

CVE-2024-58274

Hikvision CSMP Comprehensive Security Management Platform iSecure Center through 2024-08-01 allows execution of a command within $ in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025...

Malicious code in test-all1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b9b13c552c50461f4b3a7a423bf9fc79e3a5ea1c36d107ecd7536223789616aa The OpenSSF Package Analysis project identified 'test-all1' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2025-7850

CVE-2025-7850 is an authenticated OS command injection affecting TP-Link Omada gateway devices. The TP-Link/THN coverage describes exploitation via the WireGuard VPN settings where improper sanitization enables arbitrary OS commands (root) after admin authentication, with two other Omada flaws pa...

CVE-2025-6542 OS command injection in multiple parameters

An arbitrary OS command may be executed on the product by a remote unauthenticated attacker...

EUVD-2025-35118

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface...

CVE-2025-6541

CVE-2025-6541 affects TP-Link Omada gateway devices. The flaw allows command injection in the device OS via the web management interface, exploitable by an authenticated user to run arbitrary commands. Impact is high per CVSS. TP-Link issued firmware updates addressing this and similar flaws; use...

ZOHO ManageEngine ADManager Plus 安全漏洞

ZOHO ManageEngine ADManager Plus is a suite of Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. The software assists AD administrators and helpdesk technicians with day-to-day administrative tasks, such as batch management of user...