EUVD-2023-41191

Malicious code in bioql PyPI...

EUVD-2021-8133

Malicious code in bioql PyPI...

EUVD-2023-32364

Malicious code in bioql PyPI...

CVE-2025-59741

AndSoft e-TMS v25.03 suffers an OS command injection that can be triggered by sending a POST request to /CLT/LOGINERRORFRM.ASP with the m parameter. Multiple connected sources (CNVD-2025-23538, NVD/CVE-2025-59741, CNNVD-202510-331, PT-2025-40361) confirm the vulnerability exists and that an attac...

CVE-2025-34184 Ilevia EVE X1 Server 4.7.18.0.eden Neuro-Core Unauthenticated Code Injection

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, leading to full system compromise or...

CVE-2025-10358 Wavlink WL-WN578W2 wireless.cgi sub_404850 os command injection

A security vulnerability has been detected in Wavlink WL-WN578W2 221110. This affects the function sub404850 of the file /cgi-bin/wireless.cgi. The manipulation of the argument deletelist leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly...

Linux Distros Unpatched Vulnerability : CVE-2023-45158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging not the default...

PT-2025-36562

SAP NetWeaver and Affected Versions SAP NetWeaver versions 5.3 through 10.0 SAP NetWeaver AS Java affected versions not specified Description SAP NetWeaver contains a critical deserialization flaw in the RMI-P4 module. This allows an unauthenticated attacker to execute arbitrary operating system...

PT-2025-34975

Name of the Vulnerable Software and Affected Versions: SS1 versions 16.0.0.10 and earlier SS1 Media versions 16.0.0a and earlier Description: SS1 versions 16.0.0.10 and earlier Media version 16.0.0a and earlier allow a remote, unauthenticated attacker to upload arbitrary files and execute OS...

CVE-2025-8943 Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...

VulnCheck KEV: CVE-2022-40799

Data Integrity Failure in 'Backup Config' in D-Link DNR-322L = 2.60B15 allows an authenticated attacker to execute OS level commands on the device...

NewStart CGSL MAIN 7.02 : less Vulnerability (NS-SA-2025-0106)

The remote NewStart CGSL host, running version MAIN 7.02, has less packages installed that are affected by a vulnerability: - less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires us...

CVE-2015-10141 Xdebug Remote Debugger Unauthenticated OS Command Execution

An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker ca...

📄 Tiki Wiki CMS Groupware 28.3 Server-Side Template Injection

Tiki Wiki CMS Groupware versions 28.3 and below suffer from two server-side template injection vulnerabilities via specially crafted wiki pages. ---------------------------------------------------------------------------------- Tiki Wiki CMS Groupware '" The second vulnerability can be leveraged ...

CVE-2025-34087

An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the...

CVE-2025-34087

CVE-2025-34087: An authenticated command-injection in Pi-hole’s web interface (legacy AdminLTE) exists up to version 3.3, where unsanitized domain input added to the allowlist can be exploited to execute OS commands as the Pi-hole service user. The issue is tied to the legacy AdminLTE interface a...

CVE-2025-5306 Command Injection in Netflow path

Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778...

Crafter Studio Groovy Sandbox Bypass

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE Remote Code...

PT-2025-26243

Name of the Vulnerable Software and Affected Versions CrafterCMS versions 4.0.0 through 4.2.2 Description An issue exists in Crafter Studio of CrafterCMS that allows authenticated developers to execute operating system commands. This is due to improper control of dynamically-managed code resource...

CVE-2025-49141 HaxCMS-PHP Command Injection Vulnerability

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the gitImportSite functionality obtains a URL string from a POST request and insufficiently validates user input. The setremote function later passes this input into procopen, yielding OS...