PT-2025-42502

Name of the Vulnerable Software and Affected Versions Ilevia EVE X1 Server firmware versions through 4.7.18.0.eden Description The software contains authenticated OS command injection flaws in several web-accessible PHP scripts. These scripts utilize the exec function, enabling a verified attacke...

CVE-2025-34514: Improper Neutralization of Special Elements used in an OS Command

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and...

PT-2025-42503

Name of the Vulnerable Software and Affected Versions Ilevia EVE X1 Server firmware versions through 4.7.18.0.eden Description The software contains an execution with unnecessary privileges issue in the sync project.sh component. This allows an attacker to escalate privileges to root. The vendor...

Ilevia EVE X1 Server 4.7.18.0.eden (mbus) Unauthenticated Remote Command Injection

Summary EVE is a smart home and building automation solution designed for both residential and commercial environments, including malls, hotels, restaurants, bars, gyms, spas, boardrooms, and offices. It enables comprehensive control and monitoring of electrical installations through a highly...

Ilevia EVE X1 Server 4.7.18.0.eden Unauthenticated Reflected XSS

Summary EVE is a smart home and building automation solution designed for both residential and commercial environments, including malls, hotels, restaurants, bars, gyms, spas, boardrooms, and offices. It enables comprehensive control and monitoring of electrical installations through a highly...

EUVD-2007-1772

Malware in sbrugna...

EUVD-2025-29648

Malicious code in bioql PyPI...

EUVD-2024-47157

Malicious code in bioql PyPI...

EUVD-2023-48036

Malicious code in bioql PyPI...

EUVD-2022-32391

Malicious code in bioql PyPI...

EUVD-2025-29645

Malicious code in bioql PyPI...

EUVD-2024-27343

Malicious code in bioql PyPI...

EUVD-2025-29644

Malicious code in bioql PyPI...

EUVD-2023-0075

Malicious code in bioql PyPI...

EUVD-2022-52897

Malicious code in bioql PyPI...

EUVD-2025-29646

Malicious code in bioql PyPI...

CVE-2025-34185

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a pre-authentication file disclosure vulnerability via the 'dblog' POST parameter. Remote attackers can retrieve arbitrary files from the server, exposing sensitive system information and credentials...

CVE-2025-34187

Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If these scripts are writable by web-facing users or accessible via command injection, attackers can replace them with malicious payloads...

CVE-2025-34184

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, leading to full system compromise or...

CVE-2025-34186

Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system call for authentication, allowing attackers to inject special characters and manipulate command parsing. Because the binary interprets non-zero exit...