CVE-2025-20014: Improper Neutralization of Special Elements used in an OS Command

mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system...

OpenPanel 0.3.4 Command Injection

OpenPanel version 0.3.4 suffers from a remote command injection vulnerability via the timezone parameter. Exploit Title: OpenPanel 0.3.4 - OS Command Injection via The Timezone Parameter Date: Nov 25, 2024 Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee Vendor Homepage:...

CVE-2025-20061: Improper Neutralization of Special Elements used in an OS Command

mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system...

CVE-2025-24480: Improper Neutralization of Special Elements used in an OS Command

A Remote Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to lack of input sanitation and could allow a remote attacker to run commands or code as a high privileged user...

CVE-2024-57590

TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntpsync.cgi",which allows remote attackers to execute arbitrary commands via parameter "ntpserver" passed to the "ntpsync.cgi" binary through a POST request...

CVE-2024-57595

The DLINK DIR-825 REVB 2.03 router is susceptible to an OS command injection vulnerability in the apc_client_pin.cgi CGI interface. The root cause is a failure to properly filter special characters and commands within the wps_pin parameter during request processing. A remote attacker can exploit ...

CVE-2024-57595: Improper Neutralization of Special Elements used in an OS Command

DLINK DIR-825 REVB 2.03 devices have an OS command injection vulnerability in the CGl interface apcclientpin.cgi, which allows remote attackers to execute arbitrary commands via the parameter "wpspin" passed to the apcclientpin.cgi binary through a POST request...

CVE-2024-57590

TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntpsync.cgi",which allows remote attackers to execute arbitrary commands via parameter "ntpserver" passed to the "ntpsync.cgi" binary through a POST request...

CVE-2024-57595

DLINK DIR-825 REVB 2.03 devices have an OS command injection vulnerability in the CGl interface apcclientpin.cgi, which allows remote attackers to execute arbitrary commands via the parameter "wpspin" passed to the apcclientpin.cgi binary through a POST request...

CVE-2024-57590: Improper Neutralization of Special Elements used in a Command

TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntpsync.cgi",which allows remote attackers to execute arbitrary commands via parameter "ntpserver" passed to the "ntpsync.cgi" binary through a POST request...

CVE-2025-22606: Improper Neutralization of Special Elements used in an OS Command

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes...

OS Command Injection

github.com/mayuresh82/gocast is vulnerable to OS Command Injection. The vulnerability is due to improper validation of user input in the name parameter, which allows specially crafted HTTP requests to inject and execute arbitrary OS commands...

OS Command Injection

Ray is vulnerable to Os command Injection. The vulnerability is due to improper input sanitization in the cpuprofile URL parameter, allowing attackers to execute OS commands remotely on the system running the Ray dashboard without authentication...

CVE-2025-23237

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in UD-LT2 firmware Ver.1.00.008SE and earlier. If a user logs in to CLI of the affected product, an arbitrary OS command may be executed...

CVE-2025-20617

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in UD-LT2 firmware Ver.1.00.008SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a certain screen operation, an arbitrary ...

CVE-2025-23237

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in UD-LT2 firmware Ver.1.00.008SE and earlier. If a user logs in to CLI of the affected product, an arbitrary OS command may be executed...

CVE-2025-23237

CVE-2025-23237 affects I-O DATA UD-LT2 devices running firmware 1.00.008_SE and earlier. The vulnerability is an OS Command Injection caused by improper neutralization of special elements used in an OS command. When an administrator logs in to the device CLI, an arbitrary OS command could be exec...

CVE-2025-23237

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in UD-LT2 firmware Ver.1.00.008SE and earlier. If a user logs in to CLI of the affected product, an arbitrary OS command may be executed...

CVE-2025-20617

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in UD-LT2 firmware Ver.1.00.008SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a certain screen operation, an arbitrary ...

CVE-2025-20617

CVE-2025-20617 affects I-O Data UD-LT2 firmware (versions 1.00.008_SE and earlier). The vulnerability is due to improper neutralization of special elements used in an OS command injection, allowing an administrator-authenticated user to manipulate requests for a screen operation and cause arbitra...