PT-2025-18666 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: The issue is related to a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This allows attackers to execute arbitrary commands via a crafte...

CVE-2025-44848

The TOTOLINK CA600-PoE outdoor wireless AP/CPE device, specifically version V5.3c.6665_B20180820 , is vulnerable to a command injection flaw in the msg_process function. The root cause is the lack of adequate filtering for special characters and commands within the Url parameter during request pr...

CVE-2025-44837

The TOTOLINK CPE CP900 (firmware version V6.3c.1144_B20190715 ) is vulnerable to a command injection vulnerability within the CloudSrvUserdataVersionCheck function. The root cause is the lack of proper sanitization for input data when processing the url and magicid parameters. A remote attacker c...

CVE-2025-44865

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44836

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44860

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44842

The TOTOLINK CA600-PoE outdoor wireless AP/CPE device, specifically version V5.3c.6665_B20180820 , contains a command injection vulnerability in the msg_process function. The root cause is a lack of proper filtering for special characters and commands within the Port parameter during request proc...

CVE-2025-44865

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44862

The TOTOLINK CA300-POE router (specifically version V6.2c.884_B20180522 ) contains a command injection vulnerability within the recvUpgradeNewFw function. The root cause is the failure to properly sanitize or filter special characters and commands within the fwUrl parameter during data processing...

CVE-2025-4121

A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function cmdwireless. The manipulation of the argument host leads to command injection. The attack can be launched remotely. The vendor was contacted early about this...

PT-2025-18200 · Lb Link · Lb-Link Bl-Ac3600

Name of the Vulnerable Software and Affected Versions: LB-LINK BL-AC3600 versions up to 1.0.22 Description: A critical issue has been discovered, affecting the Password Handler component. Specifically, it impacts the easy uci set option string 0 function within the /cgi-bin/lighttpd.cgi file. The...

GHSA-JMJF-MFHM-J3GF AWorld OS Command Injection vulnerability

A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function subprocess.run/subprocess.Popen of the file AWorld/aworld/virtualenvironments/terminals/shelltool.py. The manipulation leads to os command...

CVE-2025-4032 inclusionAI AWorld shell_tool.py subprocess.Popen os command injection

A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function subprocess.run/subprocess.Popen of the file AWorld/aworld/virtualenvironments/terminals/shelltool.py. The manipulation leads to os command...

Planet UNI-NMS-Lite System Command Injection Vulnerability

Planet UNI-NMS-Lite is a universal network management system from PLANET China that monitors all deployed wired or wireless PoE industrial grade network devices. Planet UNI-NMS-Lite suffers from a command injection vulnerability that can be exploited by an attacker to submit a special request to...

CVE-2025-46271

UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data...

GNU Mailman Command Injection Vulnerability

GNU Mailman is a mailing list management software commonly used to create, manage and maintain mailing lists. A command injection vulnerability exists in GNU Mailman. The vulnerability stems from a failure to properly filter shell metacharacters in the subject line of an email message. An attacke...

PT-2025-17699 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns a command injection vulnerability in the Apache HTTP Server. No specific details about the number of potentially affected devices or real-world incidents are...

CVE-2025-2773

CVE-2025-2773 refers to a command injection/remote code execution flaw in BEC Technologies' Multiple Routers. The vulnerability resides in the management interface (listening on TCP port 22 by default), where insufficient validation of a user-supplied string before a system call allows an attacke...

PT-2025-17849 · Yt-Dlp +1 · Yt-Dlp +1

Name of the Vulnerable Software and Affected Versions: YoutubeDLSharp versions 1.0.0-beta4 through 1.1.2 Description: The issue is related to an unsafe conversion of arguments, allowing the injection of malicious commands when starting yt-dlp from a command prompt on Windows OS with the...

CVE-2025-29743

The D-Link DIR-816 A2 wireless router (version A2V1.1.0B05 ) is vulnerable to a command injection flaw located in the /goform/delRouting endpoint. This vulnerability arises from a lack of measures to clean data at the control level, which can allow a remote attacker to execute arbitrary code . Ex...