CVE-2025-37146

A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2025-37146 Unauthorized Filesystem Operations in System Firmware allow Authenticated Remote Code Execution

A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2025-37146 Unauthorized Filesystem Operations in System Firmware allow Authenticated Remote Code Execution

A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2025-46581 ZTE ZXCDN product has a Struts RCE Vulnerability

ZTE's ZXCDN product is affected by a Struts remote code execution RCE vulnerability. An unauthenticated attacker can remotely execute commands with non-root privileges...

CVE-2025-46581 ZTE ZXCDN product has a Struts RCE Vulnerability

ZTE's ZXCDN product is affected by a Struts remote code execution RCE vulnerability. An unauthenticated attacker can remotely execute commands with non-root privileges...

CVE-2025-37146: Improper Neutralization of Special Elements used in a Command

A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

The vulnerability of the sub_46409C() function in the D-Link DI-7100G router’s microprogramming software, as described in the file /msp_info.htm?flag=qos, allows a hacker to execute arbitrary commands.

The vulnerability of the sub46409C function in the /mspinfo.htm?flag=qos file of the D-Link DI-7100G router’s microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability could allow a malicious actor to execute arbitrary...

The vulnerability of the sub_4BD4F8() function in the /webchat/hi_block.asp file of the D-Link DI-7100G router’s software allows a hacker to execute arbitrary commands.

The vulnerability of the sub4BD4F8 function in the /webchat/hiblock.asp file of the D-Link DI-7100G router’s software lies in the fact that the operation results are written outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the ping6() function in D-Link DSL-7740C router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the ping6 function in the microprogramming software of the D-Link DSL-7740C router is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

The vulnerability of the sub_4C0990 function in D-Link DI-7100G router’s microprogramming system allows a hacker to execute arbitrary commands.

The vulnerability of the sub4C0990 function in D-Link DI-7100G router microprogramming software is related to the execution of operations outside the buffer in memory when processing the openid parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2025-41990

Name of the Vulnerable Software and Affected Versions network access point configuration services affected versions not specified Description A flaw exists in the web-based management interface of network access point configuration services that could allow a remote attacker with authentication t...

The vulnerability of the HNAP1 protocol implementation in D-Link DIR-852 microprogrammed router software allows a hacker to execute arbitrary commands.

The vulnerability of the HNAP1 protocol implementation in D-Link DIR-852 microprogrammed router software is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-30001

The Apache StreamPark framework (versions 2.1.4 before 2.1.6 ) is vulnerable to an Incorrect Execution-Assigned Permissions flaw. The root cause is improper handling of permissions within the process responsible for executing system commands, which allows an authenticated attacker to send crafted...

EUVD-2025-33371

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Quick Template page that, when visited by another user, enables the attacker to execute commands with the target's...

CVE-2025-10283

BBOT’s gitdumper module is vulnerable due to insufficient sanitization of .git data, enabling Directory Traversal that can lead to Remote Code Execution when processing a malicious git repository. Affected component: bb ot gitdumper.py (processing of .git/config and related index/file handling as...

EUVD-2025-33343

scio is vunerable to Remote Command Execution through PyTorch...

GHSA-M9MP-6X32-5RHG scio is vunerable to Remote Command Execution through PyTorch

Impact PyTorch reported a critical vulnerability when using torch.load, even with option weightsonly=True, for torch = 2.6, starting from scio = 1.0.1 currently in dev state. Workarounds You can manually check that you are using torch = 2.6...

CVE-2025-53967

Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl command. The vulnerable endpoint fails to properly sanitize...

The vulnerability of the TOTOLINK X6000R router’s microprogramming software lies in insufficient validation of input data, allowing a hacker to execute arbitrary commands.

The vulnerability of the TOTOLINK X6000R router’s microprogramming software is related to insufficient verification of input data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

The vulnerability of the setWiFiAclRules function in the TOTOLINK X6000R router software allows a hacker to execute arbitrary commands.

The vulnerability of the setWiFiAclRules function in the TOTOLINK X6000R router software lies in the lack of measures taken to neutralize special elements during the processing of the desc parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...