PT-2025-39438

Name of the Vulnerable Software and Affected Versions Wavlink NU516U1 M16U1 V240425 affected versions not specified Description A flaw exists in the SetName Page component of the Wavlink NU516U1 M16U1 V240425. The issue resides within the sub 403198 function of the /cgi-bin/wireless.cgi file...

CVE-2025-59817: Improper Neutralization of Special Elements used in a Command

This vulnerability allows attackers to execute arbitrary commands on the underlying system. Because the web portal runs with root privileges, successful exploitation grants full control over the device, potentially compromising its availability, confidentiality, and integrity...

Wavlink NU516U1: Command Injection Vulnerability

Wavlink NU516U1 is a wireless print server from China Ruiyin Wavlink. A command injection vulnerability exists in the Wavlink NU516U1 M16U1V240425, which originates from a misbehavior of the function sub4016F0 in the file /cgi-bin/firewall.cgi with respect to the parameter delflag, which could le...

PT-2025-39441

Name of the Vulnerable Software and Affected Versions Wavlink NU516U1 M16U1 V240425 Description A security flaw exists in the Wavlink NU516U1 M16U1 V240425. The issue is due to command injection in the /cgi-bin/firewall.cgi file, specifically within the sub 4016F0 function. Manipulation of the de...

Tenda AC6 formSetIptv Arbitrary Command Execution

The vulnerability of the formSetIptv function in the Tenda AC6 router’s microprogramming software is related to the failure to take measures to neutralize special elements used in the operating system’s commands when processing parameters list and vlanId. Exploiting this vulnerability allows a...

CVE-2025-10814

A vulnerability was determined in D-Link DIR-823X 240126/240802/250416. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/goahead. This manipulation of the argument port causes command injection. The attack can be initiated remotely. The exploit has been publicly...

Exploit for Origin Validation Error in Edex-Ui_Project Edex-Ui

CVE-2023-30856 Security Patch for eDEX-UI ⚠️ Critical Secu...

CVE-2025-10775

A security vulnerability has been detected in Wavlink WL-NU516U1 240425. This vulnerability affects the function sub4012A0 of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to os command injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-10774

A weakness has been identified in Ruijie 6000-E10 up to 2.4.3.6-20171117. This affects an unknown part of the file /view/vpn/autovpn/subcommit.php. This manipulation of the argument key causes os command injection. It is possible to initiate the attack remotely. The exploit has been made availabl...

CVE-2025-20334: Improper Neutralization of Special Elements used in a Command

A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system. This vulnerability is due to insufficient input validation. An attacker with administrative privileges...

Tenda AC23 sscanf Command Execution

The vulnerability of the sscanf function in Tenda AC23 router microprogramming software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Linksys Router Command Execution

The vulnerability of the microprogrammed software of Linksys routers such as E4200, E3200, E3000, E2500, E2100L, E2000, E1550, E1500, E1200, E1000, and E900 is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitra...

D-link DIR-823X Arbitrary Command Execution

The vulnerability of the /usr/sbin/goahead file in the microprogramming software for D-link DIR-823X routers is related to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

pub.xslt.Transformations Transformations Arbitrary Command Execution

The vulnerability of the pub.xslt.Transformations:transformSerialXML service on the IBM WebMethods Integration platform relates to insufficient processing of the format string. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...

PT-2025-40814

Name of the Vulnerable Software and Affected Versions Belkin F9K1015 version 1.00.10 Description A flaw exists in Belkin F9K1015 version 1.00.10 that allows for command injection. The issue is located in the file /goform/formSetWanStatic. Manipulation of the m wan ipaddr argument can lead to remo...

PT-2025-40808

Name of the Vulnerable Software and Affected Versions Belkin F9K1015 version 1.00.10 Description A flaw exists in Belkin F9K1015 version 1.00.10 that allows for command injection. This occurs through manipulation of the wan ipaddr argument within an unknown function of the...

VulnCheck KEV: CVE-2025-7414

A vulnerability classified as critical was found in Tenda O3V2 1.0.0.123880. This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be initiated remotely...

CVE-2025-10814

A vulnerability was determined in D-Link DIR-823X 240126/240802/250416. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/goahead. This manipulation of the argument port causes command injection. The attack can be initiated remotely. The exploit has been publicly...

CVE-2025-10814

A vulnerability was determined in D-Link DIR-823X 240126/240802/250416. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/goahead. This manipulation of the argument port causes command injection. The attack can be initiated remotely. The exploit has been publicly...

CVE-2025-57685

The LB-Link routers, including the BL-AC2100AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000AE4 v2.4.9, BL-AC1900AZ2 v1.0.2, BL-X26AC8 v1.2.8, and BL-LTE300DA4 V1.2.3 models, are vulnerable to unauthorized command injection. Attackers can exploit this vulnerability by accessing the /goform/setserialcfg...