TOTOLINK N300RH Set WebWlanIdx Command Execution

The vulnerability of the setWebWlanIdx function in the microprogrammed software of TOTOLINK N300RH routers is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Lighttpd SetDiagnosisCfg Command Injection

The vulnerability of the setDiagnosisCfg handler in the /usr/sbin/lighttpd executable file of the TOTOLINK X5000R router microprogramming system is related to the insertion or modification of arguments. Exploiting this vulnerability allows a remote attacker to insert arbitrary command-line...

TOTOLINK X6000R NTPSyncWithHost Handler Command Execution

The vulnerability of the NTPSyncWithHost handler in the /usr/sbin/shttpd executable of the X6000R router microprogramming system exists due to the lack of measures taken to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to...

NewStart CGSL MAIN 6.06 (SP) : vim Vulnerability (NS-SA-2026-0010)

The remote NewStart CGSL host, running version MAIN 6.06 SP, has vim packages installed that are affected by a vulnerability: - getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated...

TOTOLINK X5000R setIptvCfg Command Execution

The vulnerability of the setIptvCfg handler in the /usr/sbin/lighttpd executable file of the TOTOLINK X5000R router microprogramming system exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a...

pgAdmin 4 Command Execution

The vulnerability of the pgAdmin 4 database management tool is related to access control errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2026-3485

A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub1BF84 of the component SSDP Service. This manipulation of the argument ST causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This vulnerability...

📄 Juniper JunosEvolved Remote Command Execution

This Metasploit module exploits an unauthenticated command injection vulnerability in the Juniper JunosEvolved API. The exploit workflow involves creating a custom command entity, mapping it to a Directed Acyclic Graph DAG, and triggering an execution instance. The module uses a non-destructive...

Unity Linux 20.1060e / 20.1070e Security Update: atril (UTSA-2026-005397)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005397 advisory. Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in...

CVE-2025-52365

A command injection vulnerability in the szc script of the ccurtsinger/stabilizer repository allows remote attackers to execute arbitrary system commands via unsanitized user input passed to os.system. The vulnerability arises from improper input handling where command-line arguments are directly...

D-link DIR-823X Router Arbitrary Command Execution

The vulnerability of the /goform/setacstatus function in D-link DIR-823X router microprogramming software is related to the failure to eliminate special elements during the processing of parameters acipaddr/acipstatus/aprandtime. Exploiting this vulnerability allows a remote attacker to execute...

D-Link DIR-600 B5 Router ssdp.cgi Command Execution

The vulnerability of the ssdp.cgi file of the D-Link DIR-600 B5 router’s microprogramming system is related to insufficient checking of arguments passed in the command when processing the parameters HTTPST/REMOTEADDR/REMOTEPORT/SERVERID. Exploiting this vulnerability allows a remote attacker to...

UTT 521G Router Sub_446B18 Arbitrary Command Execution

The vulnerability of the sub446B18 function in the /goform/formPdbUpConfig file of the UTT 521G router microprogramming system is related to the failure to take measures to neutralize special elements used in the operating system’s command processing when handling the policyNames parameter...

D-link DIR-823X Sub Process Arbitrary Command Execution

The vulnerability of the sub420688 /goform/setqos function in D-link DIR-823X router microprogramming software is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by sending specially craft...

UTT HiPER 810 Router Arbitrary Command Execution

The vulnerability of the sub43F020 /goform/formPdbUpConfig function in the UTT HiPER 810 router microprogramming system is related to the lack of measures taken for data cleaning at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

Tenda AC15 Sub B0488 Function Arbitrary Command Execution

The vulnerability of the subB0488 function goform/formSetIptv in the microprogramming software for Tenda AC15 is related to incorrect handling of code generation in memory when processing the parameter s11. Exploiting this vulnerability can allow an attacker to execute arbitrary commands remotely...

Tenda W20E Router Arbitrary Command Execution

The vulnerability of the addWewifiWhiteUser function in the goform/formAddWewifiWhiteUser function of the Tenda W20E router’s microprogramming software is related to the execution of operations outside the buffer in the userInfo parameter’s memory. Exploiting this vulnerability could allow a remo...

Tenda W20E Router Arbitrary Command Execution

The vulnerability of the addAuthUser function goform/formAddWebAuthUse in the Tenda W20E router microprogramming system lies in the fact that the operation’s output escapes the buffer and is stored in the userInfo parameter’s memory. Exploiting this vulnerability allows a remote attacker to execu...

Tenda W20E Arbitrary Command Execution

The vulnerability of the pPortMapIndex function implemented in goform/formDelPortMapping of the Tenda W20E router software is related to the execution of operations outside the buffer in the parameter strcpy area of memory. Exploiting this vulnerability allows a remote attacker to execute arbitra...

Tenda W20E doSystemCmd Command Execution

The vulnerability of the doSystemCmd goform/formSetUSBPartitionUmount function in the Tenda W20E router microprogramming system is related to incorrect handling of code generation in memory when processing the usbPartitionName parameter. Exploiting this vulnerability allows an attacker to execute...