Important Photon OS Security Update - PHSA-2025-5.0-91-0694

Updates of 'libpng', 'linux', 'linux-esx' packages of Photon OS have been released...

CVE-2025-62354

Improper neutralization of special elements used in an OS command 'command injection' in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution...

SDMC NE6037: Operating System Command Injection Vulnerability

The SDMC NE6037 is a cable modem from China's Sinodisk SDMC. An operating system command injection vulnerability exists in the SDMC NE6037 versions prior to 7.1.12.2.44, which stems from a shell command injection vulnerability in the Network Diagnostic Tool...

VulnCheck KEV: CVE-2025-8943

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...

Important Photon OS Security Update - PHSA-2025-5.0-0691

Updates of 'cifs-utils', 'linux-esx', 'linux' packages of Photon OS have been released...

Zenitel TCIV-3+ IP video door phones Command Injection

The vulnerability of the microprogrammed software of the Zenitel TCIV-3+ IP video door phones is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Zenitel TCIV-3+ IP video door phones Command Injection

The vulnerability of the microprogrammed software of the Zenitel TCIV-3+ IP video door phones is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-64127

An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to execute arbitrary commands remotely...

CVE-2025-64128

An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, which could permit attackers to append arbitrary data. This could allow an unauthenticated attacker to inject arbitrary commands...

CVE-2025-64127

Zenitel TCIV-3+ OS command injection (CVE-2025-64127) arises from insufficient input sanitization, with user-supplied parameters being incorporated into OS commands. This could allow an unauthenticated attacker to remotely execute arbitrary commands. Affected product: Zenitel TCIV-3+ IP intercom ...

CVE-2025-62354

Improper neutralization of special elements used in an OS command 'command injection' in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution...

CVE-2025-62354

Improper neutralization of special elements used in an OS command 'command injection' in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution...

EUVD-2025-199679

Unauthenticated OS Command Injection startupgrade.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform User input passed directly to exec allows remote code execution via...

EUVD-2025-199672

Unauthenticated OS Command Injection restoresettings.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform URL-decoded name parameter passed to exec allows remote code execution. The...

Zephyr security vulnerabilities

Zephyr is an extensible real-time operating system RTOS open-sourced by Zephyr. A security vulnerability exists in Zephyr that stems from an out-of-bounds write that could lead to the execution of arbitrary code or a denial-of-service attack...

PT-2025-48189

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-657BRM version 1.00.1 Description The TRENDnet TEW-657BRM device version 1.00.1 contains an authenticated remote OS command injection issue in the setup.cgi binary. An attacker can exploit this by manipulating the HTTP parameters...

Cursor security vulnerabilities

Cursor is an AI code editor from Cursor open source. A security vulnerability exists in Cursor that stems from improper neutralization of special elements in OS commands, which could lead to arbitrary code execution...

PT-2025-48141

Name of the Vulnerable Software and Affected Versions Cursor affected versions not specified Description An improper neutralization of special elements used in an OS command 'command injection' exists in Cursor. This allows an unauthorized attacker to execute commands that are outside of those...

IBM DB2 Information Disclosure and Credential Exposure (7250484) (Unix)

According to its self-reported version number, IBM Db2 on Unix may be affected by a vulnerability: - IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows includes Db2 Connect Server clpplus command exposes user credentials to the terminal...

NIM Server Arbitrary Command Execution

The vulnerability of the NIM server for the IBM AIX and IBM VIOS operating systems is related to improper process management. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...