Remote Code Execution (RCE)

Picklescan is vulnerable to Remote Code Execution RCE. The vulnerability is due to insufficient detection of dangerous deserialization behavior due to bypassing security checks by invoking benign built-in functions like timeit.timeit in the reduce method, which are not blacklisted and allow...

GHSA-QQ2H-M2HJ-HRFF DevDojo Voyager Argument Injection vulnerability

DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command...

CVE-2025-0119 Cortex XDR Broker VM: Authenticated Command Injection Vulnerability in Broker VM

A command injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary OS commands with root privileges on the host operating system running Broker VM...

CVE-2025-3362

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

CVE-2025-3363

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

📄 Cosy+ 21.2s7 Command Injection

Cosy+ firmware version 21.2s7 command injection proof of concept exploit. Hey, Overview: The Ewon Cosy+ is a VPN gateway used for remote access and maintenance in industrial environments. The manufacturer describes the product as follows see 1: "The Ewon Cosy+ gateway establishes a secure VPN...

PT-2025-15682 · Unknown · Ac-Wps-11Ac Series

Name of the Vulnerable Software and Affected Versions: Wi-Fi AP UNIT 'AC-WPS-11ac series' affected versions not specified Description: A critical issue exists in the Wi-Fi AP UNIT 'AC-WPS-11ac series' due to an OS command injection vulnerability in a specific service. This vulnerability allows a...

CVE-2025-3361 HGiga iSherlock - OS Command Injection

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

CVE-2025-3361

The CVE-2025-3361 entry concerns the iSherlock web service from HGiga, which is reported to have an OS Command Injection vulnerability. The vulnerability allows unauthenticated remote attackers to inject and execute arbitrary OS commands on the server. The available documents consistently describ...

CVE-2024-12009

A post-authentication command injection vulnerability in the "ZyEE" function of the Zyxel EX5601-T1 firmware version V5.70ACDZ.3.6C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a vulnerable device...

The vulnerability of the CLI component of Fortinet’s FortiAP-S, FortiAP-W2, and FortiAP software solutions allows attackers to execute arbitrary commands.

The vulnerability of the CLI component of Fortinet’s FortiAP-S/W2 and FortiAP products exists due to the failure to take measures to neutralize the special elements used in the operating system commands. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

CVE-2025-22368

The CVE-2025-22368 issue affects Mennekes Smart / Premium Chargingpoints (authenticated SCU firmware) where OS commands are not properly neutralized, enabling command execution via certain fields passed to the underlying OS. Public details in connected docs indicate the vulnerability exists in th...

CVE-2024-11253

A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version V5.50ABOM.8.5C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a...

CVE-2024-12010

A post-authentication command injection vulnerability in the ”zyUtilMailSend” function of the Zyxel AX7501-B1 firmware version V5.17ABPC.5.3C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a vulnerable device...

Linux Distros Unpatched Vulnerability : CVE-2023-38323

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the status path script entry in the configuration file, allowing attackers that have dire...

Linux Distros Unpatched Vulnerability : CVE-2019-20807

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces e.g., Python, Ruby, or Lua...

CVE-2024-53944

An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUIv1.0.1802.10.08P4 and LT21B devices through M7628xUSAxUIv2v1.0.1481.15.02P0. A unauthenticated remote attacker with network access can exploit a command injection vulnerability. The /goform/formJsonAjaxReq...

CVE-2025-25894

The D-Link DSL-3782 wireless router (firmware version v1.01 ) contains an OS command injection vulnerability. The flaw exists in the microprogramming software due to a lack of sufficient measures to neutralize special characters during the processing of the samba_wg and samba_nbn parameters. A re...

CVE-2025-25895

The D-Link DSL-3782 wireless router (version v1.01 ) is susceptible to an OS command injection vulnerability. The root cause is the improper neutralization of special elements during the processing of the public_type parameter. A remote attacker can exploit this by submitting a crafted packet to ...

Zyxel DSL CPE OS Command Injection Vulnerability

Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet...