CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2013-3307: Improper Neutralization of Special Elements used in an OS Command

Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi pingip parameter on TCP port 52000...

CVE-2013-3307

CVE-2013-3307 enables OS command injection in Linksys E1000 (up to 2.1.02), E1200 (up to 2.0.04/05), and E3200 (up to 1.0.04) via the apply.cgi ping_ip parameter on TCP 52000. The root cause is shell metacharacters in ping_ip allowing arbitrary commands. Impacts include potential remote code exec...

PT-2025-29244 · Phpthumb · Phpthumb

Name of the Vulnerable Software and Affected Versions: phpThumb versions through 1.7.23 Description: The gif outputAsJpeg function in phpThumb through version 1.7.23 allows for OS Command Injection via a crafted parameter value in phpthumb.gif.php. This issue is addressed in version...

CVE-2025-52994: Improper Neutralization of Special Elements used in an OS Command

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2025-52988: Improper Neutralization of Special Elements used in an OS Command

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a high privileged, local attacker to escalated their privileges to root. When a user provides specifically crafted argument...

CVE-2025-50121: Improper Neutralization of Special Elements used in an OS Command

A CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause unauthenticated remote code execution when a malicious folder is created over the web interface HTTP when enabled. HTTP is disabled by default...

CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

Ivanti Endpoint Manager Mobile 12.5.0.x < 12.5.0.2 / 12.4.0.x < 12.4.0.3 / 12.x < 12.3.0.3 Multiple Vulnerabilities

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is 12.5.0.x prior to 12.5.0.2, 12.4.0.x prior to 12.4.0.3, or 12.x prior to 12.3.0.3. It is, therefore, affected by multiple vulnerabilities: - OS command injection in Ivanti Endpoint Manager Mobil...

CVE-2025-52994

The CVE-2025-52994 entry describes an OS Command Injection in phpThumb prior to version 1.7.24, caused by gif_outputAsJpeg in phpthumb.gif.php when given a crafted parameter. Affected versions include 1.7.23 and earlier; the issue is fixed in 1.7.23-202506081709, with advisories indicating upgrad...

CVE-2025-49537

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user...

CVE-2025-7414

A vulnerability classified as critical was found in Tenda O3V2 1.0.0.123880. This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be initiated remotely...

CVE-2025-7414

A vulnerability classified as critical was found in Tenda O3V2 1.0.0.123880. This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be initiated remotely...

CVE-2025-7414 Tenda O3V2 httpd setPingInfo fromNetToolGet os command injection

A vulnerability classified as critical was found in Tenda O3V2 1.0.0.123880. This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be initiated remotely...

CVE-2025-7414

CVE-2025-7414 affects Tenda O3V2 1.0.0.12(3880). The vulnerability is in the httpd component’s file /goform/setPingInfo, specifically the fromNetToolGet function, where manipulation of the domain argument leads to operating system command injection. This can be exploited remotely and publicly dis...

CVE-2025-34095

An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute code, which is then persisted on...

CVE-2025-34095 Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lsp

An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute code, which is then persisted on...

CVE-2025-34095

An OS command injection exists in Real Time Logic Mako Server v2.5 and v2.6 via the examples/save.lsp tutorial interface. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute() code, which is persisted on disk and later executed when a GET is issued to ex...