CVE-2025-34033 5VTechnologies Blue Angel Software Suite OS Command Injection

An OS command injection vulnerability exists in the Blue Angel Software Suite running on embedded Linux devices via the pingaddr parameter in the webctrl.cgi script. The application fails to properly sanitize input before passing it to the system-level ping command. An authenticated attacker can...

PT-2025-26684 · Sapido · Sapido Brc76N +11

Name of the Vulnerable Software and Affected Versions: Sapido BR071n version All Sapido BR261c version All Sapido BR270n version All Sapido BR476n version All Sapido BRC70n version All Sapido BRC70x version All Sapido BRC76n version All Sapido BRD70n version All Sapido BRE70n version All Sapido...

PT-2025-26695 · Unknown · Wrh-733Gbk +1

Name of the Vulnerable Software and Affected Versions: WRH-733GBK and WRH-733GWH affected versions not specified Description: The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection', in the telnet function. A remote...

PT-2025-26693 · Unknown · Wrc-X3000Gs

Name of the Vulnerable Software and Affected Versions: WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN affected versions not specified Description: The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This occurs in the...

PT-2025-26696 · Unknown · Wrh-733Gbk +1

Name of the Vulnerable Software and Affected Versions: WRH-733GBK and WRH-733GWH affected versions not specified Description: The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection', in the miniigd SOAP service. A remote...

JVN#39435597: Multiple vulnerabilities in ELECOM wireless LAN routers

Multiple wireless LAN routers provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below. Unrestricted upload of file with dangerous type CWE-434 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 5.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score 4...

PT-2025-26662

Name of the Vulnerable Software and Affected Versions: EnGenius EnShare Cloud Service versions 1.4.11 and earlier Description: An OS command injection issue exists due to the usbinteract.cgi script's failure to properly sanitize user input passed to the path parameter. This allows unauthenticated...

PT-2025-26663

Name of the Vulnerable Software and Affected Versions: TVT DVR Cross Web Server affected versions not specified Description: An OS command injection issue exists in the custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82. The web interface fails to sanitize input in...

PT-2025-26660 · Unknown · Blue Angel Software Suite

Name of the Vulnerable Software and Affected Versions: Blue Angel Software Suite affected versions not specified Description: An OS command injection vulnerability exists in the Blue Angel Software Suite running on embedded Linux devices via the ping addr parameter in the webctrl.cgi script. The...

PT-2025-26672

Name of the Vulnerable Software and Affected Versions: Sangfor Endpoint Detection and Response EDR management platform versions 3.2.16, 3.2.17, and 3.2.19 Description: The issue is an OS command injection vulnerability that allows unauthenticated attackers to send malicious HTTP requests to the E...

CVE-2025-6299

A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the file /boa/formWSC. The manipulation of the argument targetAPSsid leads to os command injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-34029

An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler. The /goform/formSysCmd endpoint exposes a system command interface through the sysCmd parameter. A remote authenticated attacker can submit arbitrary shell...

CVE-2025-34030

An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject shell commands by appending them to t...

CVE-2025-34024

An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint improperly handles user-supplied input to the command parameter. An authenticated attacker can inject shell commands using shell metacharacter...

CVE-2025-50201

WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was identified in the /html/configuracao/debuginfo.php endpoint. The branch parameter is not properly sanitized before being concatenated and executed in a shell command on the server...

VulnCheck KEV: CVE-2025-34036

An OS command injection vulnerability exists in white-labeled DVRs manufactured by TVT, affecting a custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82. The web interface fails to sanitize input in the URI path passed to the language extraction functionality. When...

PT-2025-26590

Name of the Vulnerable Software and Affected Versions Meridian Technique Materialise OrthoView versions through 7.5.1 Description Meridian Technique Materialise OrthoView through version 7.5.1 is susceptible to an OS Command Injection when servlet sharing is enabled. This allows for potential...

CVE-2025-23049

Meridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled...

CVE-2025-23049

Meridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled...

CVE-2025-23049

CVE-2025-23049 affects Meridian Technique Materialise OrthoView versions up to 7.5.1. The vulnerability is an OS command injection that arises when servlet sharing is enabled, due to improper handling of user-supplied input in the servlet sharing component. Practical impact is described as potent...