CVE-2025-65008

In WODESYS WD-R608U router also known as WDR122B V2.0 and WDR28 due to lack of validation in the langGet parameter in the adm.cgi endpoint, the malicious attacker can execute system shell commands. The vendor was notified early about this vulnerability, but didn't respond with the details of...

CVE-2025-20393 Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due...

CVE-2025-20393

CVE-2025-20393 affects Cisco AsyncOS Software on Cisco Secure Email Gateway (SEG) and Cisco Secure Email and Web Manager (SEWM) appliances. The vulnerability stems from improper input validation in the Spam Quarantine feature, allowing unauthenticated remote attackers to execute arbitrary command...

CVE-2025-20393

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due...

CVE-2025-20393 Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due...

CVE-2025-63414

A Path Traversal vulnerability in the Allsky WebUI version v2024.12.0606 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute...

CVE-2025-20393: Improper Input Validation

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due...

The vulnerability of NETGEAR R6260 and R6850 Wi-Fi router microprogramming software, related to insufficient input data verification, allows attackers to execute arbitrary commands.

The vulnerability of NETGEAR R6260 and R6850 Wi-Fi router microprogramming systems is related to insufficient verification of input data. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

The vulnerability of NETGEAR RAX30 and RAXE300 microprogrammed software drivers lies in authentication process errors, allowing attackers to execute arbitrary commands.

The vulnerability of NETGEAR RAX30 and RAXE300 microprogrammed software drivers is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to execute arbitrary commands remotely...

The vulnerability of the Telnet Service component of the wireless router WIRELESS-N 300M software allows a hacker to execute arbitrary commands.

The vulnerability of the Telnet Service component of the wireless router WIRELESS-N 300M software lies in the use of default login credentials. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the cstecgi.cgi script in the microprogramming software for the ToToLink LR1200GB router allows a hacker to execute arbitrary commands.

The vulnerability of the cstecgi.cgi microprogramming system in the ToToLink LR1200GB router lies in the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands during the processing of the imei parameter...

The vulnerability of Zyxel network devices’ microprogramming software arises from the lack of measures taken to neutralize special elements used in the operating system commands. This vulnerability allows attackers to execute arbitrary operating system commands.

The vulnerability of Zyxel network devices’ microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary operating system commands during...

The vulnerability of the setDiagnosisCfg function in the TOTOLink A950RG router’s microprogramming software allows a intruder to execute arbitrary commands.

The vulnerability of the setDiagnosisCfg function in the TOTOLink A950RG router’s microprogramming system is related to the failure to take measures to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2023-53872

Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&' operators to execute malicious code...

CVE-2023-53885

CVE-2023-53885 affects Webutler v3.2 and enables remote code execution via arbitrary file upload. The vulnerability allows authenticated administrators to upload PHP files (e.g., a PHAR containing embedded system commands) through the media browser and subsequently execute commands by accessing t...

CVE-2023-53881 ReyeeOS 1.204.1614 Man-in-the-Middle Remote Code Execution via CWMP

ReyeeOS 1.204.1614 contains an unencrypted CWMP communication vulnerability that allows attackers to intercept and manipulate device communication through a man-in-the-middle attack. Attackers can create a fake CWMP server to inject and execute arbitrary commands on Ruijie Reyee Cloud devices by...

CVE-2023-53872 Wp2Fac 1.0 OS Command Injection via send.php Endpoint

Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&' operators to execute malicious code...

CVE-2023-53872

Wp2Fac 1.0 has an OS command injection vulnerability in the send.php endpoint. The vulnerability allows remote attackers to execute arbitrary system commands by injecting shell commands through the numara parameter (using & to chain commands). Impact is described as high for confidentiality, inte...

CVE-2023-53872 Wp2Fac 1.0 OS Command Injection via send.php Endpoint

Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&' operators to execute malicious code...

CVE-2025-64986

A command injection vulnerability was discovered in TeamViewer DEX former 1E DEX, specifically within the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction prior V21. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands...