SAMSUNG WLAN AP WEA453e 安全漏洞

The SAMSUNG WLAN AP WEA453e is a wireless LAN access point from Samsung South Korea. A security vulnerability exists in the SAMSUNG WLAN AP WEA453e prior to version 5.2.4.T1, which stems from improper validation of inputs to the Tech Support diagnostic function, which could lead to remote command...

CVE-2025-52376: Improper Authentication

An authentication bypass vulnerability in the /web/umopentelnet.cgi endpoint in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below, allowing an attacker to remotely enable the Telnet service without authentication, bypassing security controls. The Telnet server is then accessible wi...

CVE-2025-34103: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undocumented /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a system call, allowing an unauthenticat...

CVE-2025-34116: Improper Neutralization of Special Elements used in an OS Command

A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server...

PT-2025-29557 · Ipfire · Ipfire

Name of the Vulnerable Software and Affected Versions: IPFire versions prior to 2.19 Core Update 101 Description: A remote command execution issue exists in IPFire due to a flaw in the proxy.cgi CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in...

The vulnerability of the IBM Storage Scale cluster file system, related to the lack of data cleaning measures at the management level, allows attackers to escalate their privileges and execute arbitrary commands.

The vulnerability of the IBM Storage Scale cluster file system is related to the lack of measures taken at the management level to clean up data. Exploiting this vulnerability can allow a malicious actor to enhance their privileges and execute arbitrary commands remotely...

CVE-2025-34068: Missing Authentication for Critical Function

An unauthenticated remote command execution vulnerability exists in Samsung WLAN AP WEA453e firmware prior to version 5.2.4.T1 via improper input validation in the “Tech Support” diagnostic functionality. The command1 and command2 POST or GET parameters accept arbitrary shell commands that are...

PT-2025-29408 · Hgiga · Isherlock

Name of the Vulnerable Software and Affected Versions: iSherlock affected versions not specified Description: The iSherlock software by Hgiga contains an OS Command Injection vulnerability. This allows unauthenticated remote attackers to inject and execute arbitrary OS commands on the server. Thi...

CVE-2025-7451: Improper Neutralization of Special Elements used in an OS Command

The iSherlock developed by Hgiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. This vulnerability has already been exploited. Please update immediately...

Erlang/OTP SSH Server Unauthenticated Remote Command Execution (CVE-2025-32433) (Direct Check)

Binary data erlangotpsshCVE-2025-32433.nbin...

VulnCheck KEV: CVE-2025-34068

An unauthenticated remote command execution vulnerability exists in Samsung WLAN AP WEA453e firmware prior to version 5.2.4.T1 via improper input validation in the “Tech Support” diagnostic functionality. The command1 and command2 POST or GET parameters accept arbitrary shell commands that are...

VulnCheck KEV: CVE-2025-28036

TOTOLINK A950RG V4.1.2cu.5161B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter...

CVE-2025-34095

An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute code, which is then persisted on...

Exploit for OS Command Injection in Progress Loadmaster

CVE-2024-1212 - Progress Kemp LoadMaster Unauthenticated Comma...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

CVE-2022-1388 - F5 BIG-IP iControl REST Authentication Bypass...

CVE-2025-50123

A CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exists that could cause remote command execution by a privileged account when the server is accessed via a console and through exploitation of the hostname input...

CVE-2025-50123

A CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exists that could cause remote command execution by a privileged account when the server is accessed via a console and through exploitation of the hostname input...

CVE-2025-50123

A CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exists that could cause remote command execution by a privileged account when the server is accessed via a console and through exploitation of the hostname input...

CVE-2025-50123

Schneider Electric EcoStruxure IT Data Center Expert (DCE) versions 8.3 and earlier are affected by CVE-2025-50123 due to insufficient sanitization of the hostname input in the .bcsetup script. The hostname value can pass a format check yet include a semicolon and commands, causing those OS comma...

PT-2025-29224 · Juniper Networks · Juniper Networks

Name of the Vulnerable Software and Affected Versions: Juniper Networks affected versions not specified Description: A code injection issue exists that could lead to remote command execution with privileged access. This occurs when the server is accessed through a console and exploits the hostnam...