CVE-2025-54964

An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Service may inject arbitrary executables. If the Job Service is configured for local-only access, this may allow for privilege escalation in certain situations. If the Job Service is...

CVE-2025-58428

CVE-2025-58428 affects Veeder-Root TLS4B ATG system. The vulnerability stems from the SOAP-based interface being accessible through the web services handler, which enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. Reported impact incl...

CVE-2025-62713 Kottster app reinitialization can be re-triggered allowing command injection in development mode

Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution RCE vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been...

Access Control Bypass

Overview @kottster/common is a Common types and utilities for Kottster Affected versions of this package are vulnerable to Access Control Bypass via the initApp and installPackagesForDataSource actions. An attacker can gain unauthorized administrative access and execute arbitrary system commands ...

Exploit for OS Command Injection in Tenda Ac15_Firmware

Tenda-Router-VR-and-Exploit...

Veeder-Root TLS4B Automatic Tank Gauge System 命令注入漏洞

Veeder-Root TLS4B Automatic Tank Gauge System is a security management system for gas stations, tank farms, or industrial storage tanks from Veeder-Root, Inc. The Veeder-Root TLS4B Automatic Tank Gauge System suffers from a command injection vulnerability that stems from the SOAP interface being...

CVE-2025-54964

BAE SOCET GXP versions prior to 4.6.0.2 are vulnerable to an issue where an attacker capable of interacting with the GXP Job Service can inject arbitrary executables. Depending on the configuration of the Job Service, this may result in privilege escalation if access is restricted to local use, o...

CVE-2025-54964: Improper Neutralization of Special Elements used in a Command

An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Service may inject arbitrary executables. If the Job Service is configured for local-only access, this may allow for privilege escalation in certain situations. If the Job Service is...

VulnCheck KEV: CVE-2022-1703

Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Commands which potentially leads to remote command execution vulnerability or denial of service DoS attack...

PT-2025-43555

Name of the Vulnerable Software and Affected Versions BAE SOCET GXP versions prior to 4.6.0.2 Description An attacker who can interact with the GXP Job Service may be able to inject arbitrary executables. If the Job Service is configured for local access, this could lead to privilege escalation. ...

CVE-2025-58428: Improper Neutralization of Special Elements used in a Command

The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote...

CVE-2024-58274: Improper Neutralization of Special Elements used in an OS Command

Hikvision CSMP Comprehensive Security Management Platform iSecure Center through 2024-08-01 allows execution of a command within $ in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025...

The vulnerability of TP-Link Omada network gateways’ microprogramming software lies in the lack of measures to neutralize specific elements, allowing attackers to execute arbitrary commands on the operating system.

The vulnerability of TP-Link Omada network gateways’ microprogramming software is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on the operating system...

PT-2025-42823

Name of the Vulnerable Software and Affected Versions TP-Link Omada Gateway affected versions not specified Description An arbitrary OS command may be executed by a remote attacker. An unauthenticated attacker can potentially execute commands on the system. The issue allows for remote command...

CVE-2018-25118 GeoVision Command Injection RCE via /PictureCatch.cgi

GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgi that enables an attacker to execute arbitrary commands on the device. The vulnerable models have been declared end-of-life EOL by the vendor. VulnCheck has...

CVE-2018-25118

CVE-2018-25118 Affected products (from provided docs): GeoVision GV-BX1500 and GV-MFD1501 IP cameras. The vulnerability is a remote command injection via the endpoint /PictureCatch.cgi that allows an attacker to execute arbitrary commands on the device. The vendor notes these models are end-of-li...

CVE-2025-31342

An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals ESP Forum Module through 1.3 version allows remote authenticated users to execute arbitrary system commands via a malicious file...

CVE-2025-31342 Galaxy Software Services Vitals ESP Forum Module - Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals ESP Forum Module through 1.3 version allows remote authenticated users to execute arbitrary system commands via a malicious file...

The vulnerability of the /cgi-bin/adm.cgi file, a microprogramming software for Wavlink routers like WL-WN579A3, allows a hacker to execute arbitrary commands.

The vulnerability of the /cgi-bin/adm.cgi file of the Wavlink WL-WN579A3 router’s microprogramming system is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the /cgi-bin/firewall.cgi file, a microprogramming system for Wavlink routers WL-WN579A3, allows a hacker to execute arbitrary commands.

The vulnerability of the /cgi-bin/firewall.cgi file of the Wavlink WL-WN579A3 router’s microprogramming system is related to the failure to take measures to neutralize specific elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute...