CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2013-3307: Improper Neutralization of Special Elements used in an OS Command

Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi pingip parameter on TCP port 52000...

PT-2025-29244 · Phpthumb · Phpthumb

Name of the Vulnerable Software and Affected Versions: phpThumb versions through 1.7.23 Description: The gif outputAsJpeg function in phpThumb through version 1.7.23 allows for OS Command Injection via a crafted parameter value in phpthumb.gif.php. This issue is addressed in version...

CVE-2025-52994: Improper Neutralization of Special Elements used in an OS Command

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2025-52988: Improper Neutralization of Special Elements used in an OS Command

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a high privileged, local attacker to escalated their privileges to root. When a user provides specifically crafted argument...

CVE-2025-50121: Improper Neutralization of Special Elements used in an OS Command

A CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause unauthenticated remote code execution when a malicious folder is created over the web interface HTTP when enabled. HTTP is disabled by default...

CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2025-52994

The CVE-2025-52994 entry describes an OS Command Injection in phpThumb prior to version 1.7.24, caused by gif_outputAsJpeg in phpthumb.gif.php when given a crafted parameter. Affected versions include 1.7.23 and earlier; the issue is fixed in 1.7.23-202506081709, with advisories indicating upgrad...

CVE-2025-49537

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user...

CVE-2025-7414

A vulnerability classified as critical was found in Tenda O3V2 1.0.0.123880. This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be initiated remotely...

CVE-2025-7414

A vulnerability classified as critical was found in Tenda O3V2 1.0.0.123880. This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be initiated remotely...

CVE-2025-7414 Tenda O3V2 httpd setPingInfo fromNetToolGet os command injection

A vulnerability classified as critical was found in Tenda O3V2 1.0.0.123880. This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be initiated remotely...

CVE-2025-7414

CVE-2025-7414 affects Tenda O3V2 1.0.0.12(3880). The vulnerability is in the httpd component’s file /goform/setPingInfo, specifically the fromNetToolGet function, where manipulation of the domain argument leads to operating system command injection. This can be exploited remotely and publicly dis...

CVE-2025-34095

An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute code, which is then persisted on...

CVE-2025-34095 Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lsp

An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute code, which is then persisted on...

CVE-2025-34095

An OS command injection exists in Real Time Logic Mako Server v2.5 and v2.6 via the examples/save.lsp tutorial interface. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute() code, which is persisted on disk and later executed when a GET is issued to ex...

CVE-2025-6771

OS command injection in Ivanti Endpoint Manager Mobile EPMM before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve remote code execution...

CVE-2025-6770

OS command injection in Ivanti Endpoint Manager Mobile EPMM before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve remote code execution...

CVE-2025-7407

A vulnerability, which was classified as critical, was found in Netgear D6400 1.0.0.114. This affects an unknown part of the file diag.cgi. The manipulation of the argument hostname leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to th...

CVE-2025-7407

Netgear D6400 1.0.0.114 contains a remote OS command injection in the diag.cgi file, exploitable via manipulation of the host_name argument. This affects the Netgear D6400 router and is confirmed across multiple sources; exploitation is publicly disclosed and is possible remotely. The vendor note...