CVE-2025-59361

The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-59361

The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-59360

The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-59359 OS command injection in Chaos Mesh via the cleanTcs mutation

The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-59359

The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-10440

The CVE-2025-10440 issue affects D-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G devices (firmware lines 16.07.26A1, 17.12.20A1, 19.12.10A1) in the jhttpd component. The vulnerability exists in the function sub_4621DC within usb_paswd.asp and stems from improper handling of the hname ar...

CVE-2025-59361: Improper Neutralization of Special Elements used in an OS Command

The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-59359: Improper Neutralization of Special Elements used in an OS Command

The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-10440: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub4621DC of the file usbpaswd.asp of the component jhttpd. The manipulation of the argument hname leads to os comma...

CVE-2025-10441: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub433F7C of the file versionupgrade.asp of the component jhttpd. The manipulation of the argument path results in os command injection. The attack may be launched...

CVE-2025-59360: Improper Neutralization of Special Elements used in an OS Command

The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-59377: Improper Neutralization of Special Elements used in an OS Command

feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used. NOTE: this is unrelated to mcp-server-kubernetes and CVE-2025-53355...

PT-2025-37475

Name of the Vulnerable Software and Affected Versions Chaos Controller Manager affected versions not specified Description The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. This allows unauthenticated in-cluster attackers to perform remote code executio...

CVE-2025-10442: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed...

PT-2025-37476

Name of the Vulnerable Software and Affected Versions Chaos Controller Manager affected versions not specified Description The cleanIptables mutation is susceptible to OS command injection. This allows unauthenticated in-cluster attackers to potentially execute remote code across the cluster...

CVE-2025-55211: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated users of the Administrator Control Panel ACP can run arbitrary shell commands by maliciously changing languages of the framework module. This vulnerability is fixed in 17.0.21...

CVE-2025-59377

feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used. NOTE: this is unrelated to mcp-server-kubernetes and CVE-2025-53355...

CVE-2025-59377

feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used. NOTE: this is unrelated to mcp-server-kubernetes and CVE-2025-53355...

CVE-2025-10358

Wavlink WL-WN578W2 (firmware 221110) exposes an OS command injection in /cgi-bin/wireless.cgi via the delete_list argument in function sub_404850. This remote vulnerability allows arbitrary command execution and has public PoC/disclosures. Multiple sources describe the root cause as improper filt...

CVE-2025-10358: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in Wavlink WL-WN578W2 221110. This affects the function sub404850 of the file /cgi-bin/wireless.cgi. The manipulation of the argument deletelist leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly...