MAL-2025-192380 Malicious code in sketchfab-spinner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f004e2139080a087917f5cfc654423a3ed60ca232dd8a051955d6af9508b1a8f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in sketchfab-spinner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f004e2139080a087917f5cfc654423a3ed60ca232dd8a051955d6af9508b1a8f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2025-64052

An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system commands...

PHOENIX CONTACT FL SWITCH 安全漏洞

PHOENIX CONTACT FL SWITCH is an industrial grade Ethernet switch from PHOENIX CONTACT, Germany. A security vulnerability exists in PHOENIX CONTACT FL SWITCH versions prior to 3.50, which stems from improper handling of null commands by the webshell and could lead to a denial of service attack...

Billing System admin/index.php Endpoint SQL Injection Vulnerability

Billing System is a billing system. The Billing System suffers from a SQL injection vulnerability that originates when the username parameter in the admin/index.php endpoint is spliced directly into a back-end SQL query without validation. An attacker can exploit this vulnerability by submitting ...

PT-2025-50247

Name of the Vulnerable Software and Affected Versions Selea Targa IP OCR-ANPR Camera affected versions not specified Description The Selea Targa IP OCR-ANPR Camera has an unauthenticated command injection issue in the utils.php file. This allows remote attackers to execute arbitrary shell command...

NETGEAR Nighthawk 安全漏洞

NETGEAR Nighthawk is a series of wireless routers from NETGEAR. A security vulnerability exists in the NETGEAR Nighthawk R7000P 1.3.3.154 and prior versions, which stems from improper input validation and could lead to an authenticated administrator performing an OS command injection attack...

PT-2025-50271

Name of the Vulnerable Software and Affected Versions MiniDVBLinux version 5.4 Description MiniDVBLinux 5.4 contains a remote code execution issue in the SVDRP protocol. This allows remote attackers to send commands to manipulate TV systems. Specifically, crafted SVDRP commands sent through the...

CVE-2021-47728: Improper Neutralization of Special Elements used in an OS Command

Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell commands. Attackers can exploit the 'addr' and 'port' parameters to inject commands and gain www-data user access through chained local...

PT-2025-49812

Name of the Vulnerable Software and Affected Versions versions prior to 2025-41693 Description A low privileged remote attacker can use the SSH feature to execute commands directly after login. The process remains open and consumes resources, leading to reduced performance of management functions...

MAL-2025-192378 Malicious code in shop-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0306448f7e93f12777f1ee6bfa83d502c06b0a61ae631c612fabd3f8a5d6021 The package shop-api-sdk was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in shop-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0306448f7e93f12777f1ee6bfa83d502c06b0a61ae631c612fabd3f8a5d6021 The package shop-api-sdk was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-65363

Authenticated append-style command-injection Ruijie APs APRGOS 11.1.x allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the webaction.do endpoint...

MAL-2025-192377 Malicious code in gs-uitk-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2de2e606bc9fde8de540caf63cbded837e1bbbd7bc6bd2d477e38dcf89a76f0b The package gs-uitk-lodash was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in gs-uitk-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2de2e606bc9fde8de540caf63cbded837e1bbbd7bc6bd2d477e38dcf89a76f0b The package gs-uitk-lodash was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-27020

CVE-2025-27020 affects Infinera MTC-9 due to an improper SSH service configuration. A misconfigured SSH implementation allows an unauthenticated attacker to execute arbitrary commands and read/write filesystem data over the network. Affected versions are R22.1.1.0275 up to, but not including, R23...

Infinera MTC-9 安全漏洞

Infinera MTC-9 is a modular controller from Infinera USA. A security vulnerability exists in Infinera MTC-9 version R22.1.1.0275 through versions prior to R23.0, which stems from a misconfiguration of the SSH service that could result in the execution of arbitrary commands and access to file syst...

Array Networks ArrayOS AG OS Command Injection Vulnerability

Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands...

CVE-2025-64081: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in /php/apipatientschedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter...

PT-2025-49542

Name of the Vulnerable Software and Affected Versions Infinera MTC-9 versions R22.1.1.0275 through R22.9.9 Description An improper configuration of the SSH service in Infinera MTC-9 can allow an unauthenticated attacker to execute arbitrary commands and access data on the file system. The issue...