CVE-2025-6771: Improper Neutralization of Special Elements used in an OS Command

OS command injection in Ivanti Endpoint Manager Mobile EPMM before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve remote code execution...

CVE-2025-7154: Improper Neutralization of Special Elements used in an OS Command

A vulnerability, which was classified as critical, has been found in TOTOLINK N200RE 9.3.5u.6095B20200916/9.3.5u.6139B20201216. Affected by this issue is the function sub41A0F8 of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Hostname leads to os command injection. The attack ma...

CVE-2025-25269: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation...

PT-2025-28486

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager Mobile EPMM versions prior to 12.5.0.2 Ivanti Endpoint Manager Mobile EPMM version 12.4.0.3 Ivanti Endpoint Manager Mobile EPMM version 12.3.0.3 Description: The issue allows a remote authenticated attacker with high...

PT-2025-28744 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as OS Command Injection, which could lead to arbitrary code executi...

PT-2025-28479

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager Mobile EPMM versions prior to 12.5.0.2 Description: The issue allows a remote authenticated attacker with high privileges to achieve remote code execution through OS command injection. Recommendations: For versions pri...

CVE-2025-49537: Improper Neutralization of Special Elements used in an OS Command

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user...

CVE-2025-3705

A physical attacker with no privileges can gain full control of the affected device due to improper neutralization of special elements used in an OS Command 'OS Command Injection' when loading a config file from a USB drive...

CVE-2025-3626

A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command 'OS Command Injection' while uploading a config file via webUI...

CVE-2025-3705

CVE-2025-3705 describes an OS Command Injection vulnerability: loading a config file from a USB drive allows a physical attacker with no privileges to execute commands and gain full control of the affected device. Documents identify Frauscher Sensortechnik products (e.g., FDS101, FDS102, FDS-SNMP...

CVE-2025-3705 OS Command Injection via USB Config Load

A physical attacker with no privileges can gain full control of the affected device due to improper neutralization of special elements used in an OS Command 'OS Command Injection' when loading a config file from a USB drive...

CVE-2025-3705 OS Command Injection via USB Config Load

A physical attacker with no privileges can gain full control of the affected device due to improper neutralization of special elements used in an OS Command 'OS Command Injection' when loading a config file from a USB drive...

CVE-2025-3626 OS Command Injection via Config Upload in WebUI

A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command 'OS Command Injection' while uploading a config file via webUI...

CVE-2025-3626 OS Command Injection via Config Upload in WebUI

A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command 'OS Command Injection' while uploading a config file via webUI...

CVE-2025-3626

CVE-2025-3626 describes an OS Command Injection vulnerability in Frauscher Sensortechnik products (Frauscher FDS101/FDS102 and related FDS00x series) triggered when uploading configuration files via a webUI. The root cause is improper neutralization of special elements in OS commands during confi...

Multiple vulnerabilities in Nimesa Backup and Recovery

Overview Nimesa Backup and Recovery provided by Nimesa contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2025-48501 Server-side request forgery CWE-918 - CVE-2025-53473 Kentaro Kawane of GMO Cybersecurity by Ierae reported this vulnerability to IPA. JPCERT/CC...

CVE-2025-48501

An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commands may be executed on the server where the product is running...

CVE-2025-48501

An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commands may be executed on the server where the product is running...

CVE-2025-48501

CVE-2025-48501 is an OS command injection in Nimesa Backup and Recovery, affecting v2.3 and v2.4. The issue allows arbitrary OS commands to be executed on the server without user interaction over the network (high impact). Mitigation is to update the software to a fixed version per the vendor; mu...

CVE-2025-48501

An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commands may be executed on the server where the product is running...