SonicWall Confirms Active Exploitation of Flaws Affecting Multiple Appliance Models

SonicWall has revealed that two now-patched security flaws impacting its SMA100 Secure Mobile Access SMA appliances have been exploited in the wild. The vulnerabilities in question are listed below - CVE-2023-44221 CVSS score: 7.2 - Improper neutralization of special elements in the SMA100 SSL-VP...

SonicWall SMA100 Appliances OS Command Injection Vulnerability

SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user...

PT-2025-18774 · Honeywell · Honeywell Mb-Secure +1

Name of the Vulnerable Software and Affected Versions: Honeywell MB-Secure versions V11.04 through V12.53 Honeywell MB-Secure PRO versions V01.06 through V03.09 Description: The issue is related to an OS Command Injection vulnerability, allowing privilege abuse due to improper neutralization of...

CVE-2025-24351: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated low-privileged attacker to execute arbitrary OS commands in the context of user “root” via a crafted HTTP request...

AWorld OS Command Injection vulnerability

A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function subprocess.run/subprocess.Popen of the file AWorld/aworld/virtualenvironments/terminals/shelltool.py. The manipulation leads to os command...

CVE-2025-4032

A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function subprocess.run/subprocess.Popen of the file AWorld/aworld/virtualenvironments/terminals/shelltool.py. The manipulation leads to os command...

CVE-2025-4032 inclusionAI AWorld shell_tool.py subprocess.Popen os command injection

A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function subprocess.run/subprocess.Popen of the file AWorld/aworld/virtualenvironments/terminals/shelltool.py. The manipulation leads to os command...

CVE-2025-4032

A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function subprocess.run/subprocess.Popen of the file AWorld/aworld/virtualenvironments/terminals/shelltool.py. The manipulation leads to os command...

CVE-2025-4032: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function subprocess.run/subprocess.Popen of the file AWorld/aworld/virtualenvironments/terminals/shelltool.py. The manipulation leads to os command...

PT-2025-18101

Name of the Vulnerable Software and Affected Versions inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e Description A critical issue affects the subprocess.run/subprocess.Popen function of the file AWorld/aworld/virtual environments/terminals/shell tool.py, leading to os command...

CVE-2025-3729

A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some unknown processing of the file backup.php of the component Database Backup Handler. The manipulation of the argument txtdbname leads to os...

GUANGZHOU 1GE ONU Terminal Command Execution

The vulnerability of the microprogramming software in the Guangzhou 1GE ONU V2801RW and V2804RGW subscriber terminals is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute...

CVE-2025-46272 Planet Technology Network Products OS Command Injection

WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host system...

CVE-2025-46271 Planet Technology Network Products OS Command Injection

UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data...

Nice Linear eMerge E3

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary OS commands. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper...

OS Command Injection

tcg/voyager is vulnerable to OS Command Injection. The vulnerability is due to insufficient validation of input passed to a specific PHP Artisan command, allowing authenticated administrators to execute arbitrary OS commands in Laravel 8 or later...

CVE-2025-3816 westboy CicadasCMS Scheduled Task save os command injection

A vulnerability classified as critical was found in westboy CicadasCMS 2.0. This vulnerability affects unknown code of the file /system/schedule/save of the component Scheduled Task Handler. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been...

CVE-2025-3816

A vulnerability classified as critical was found in westboy CicadasCMS 2.0. This vulnerability affects unknown code of the file /system/schedule/save of the component Scheduled Task Handler. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been...

CVE-2025-3816

The CVE-2025-3816 entry concerns westboy CicadasCMS 2.0, specifically the Scheduled Task Handler’s /system/schedule/save file. The vulnerability enables os command injection and can be triggered remotely (network vector). Public exploitation details exist across multiple sources, and the issue is...

PT-2025-17386

Name of the Vulnerable Software and Affected Versions westboy CicadasCMS version 2.0 Description A critical issue was found in the Scheduled Task Handler component, specifically affecting the /system/schedule/save file. This issue leads to os command injection and can be initiated remotely. The...