CVE-2025-39240: Improper Neutralization of Special Elements used in an OS Command

Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command...

SonicWall SSLVPN Arbitrary Command Execution

The vulnerability of the SSLVPN microprogramming software for network interfaces from SonicWall SMA 100 relates to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-1041

An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0...

CVE-2025-49004

Caido is a web security auditing toolkit. Prior to version 0.48.0, due to the lack of protection for DNS rebinding, Caido can be loaded on an attacker-controlled domain. This allows a malicious website to hijack the authentication flow of Caido and achieve code execution. A malicious website load...

CVE-2025-41661

CVE-2025-41661 affects Weidmueller IE-SR-2TX-WL security routers. The vulnerability is a lack of CSRF protection in the main web interface, enabling an unauthenticated remote attacker to execute arbitrary commands with root privileges on affected devices. Several connected sources (Red Hat, NVD, ...

CVE-2025-41662

...

CVE-2025-41662

CVE-2025-41662 entry is rejected/not used and does not represent an active vulnerability.

CVE-2025-41662

...

CVE-2025-46612

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...

CVE-2024-13089

CVE-2024-13089 describes an OS command injection vulnerability in the update functionality of Nozomi Networks Guardian and CMC. The issue allows an authenticated administrator (high-privilege user) to upload update packages, and despite signatures being validated, an improper signature validation...

CVE-2025-1041 Avaya Call Management System RCE vulnerability

An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0...

CVE-2025-1041 Avaya Call Management System RCE vulnerability

An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0...

CVE-2025-46612

The Airleader Master (air compressor management device) and Airleader Easy (air compressor device) products, in versions prior to 6.36 , are vulnerable to arbitrary command execution . The root cause is an unrestricted file upload vulnerability in the Panel Designer dashboard via the wizard/works...

PT-2025-24659

Name of the Vulnerable Software and Affected Versions Airleader Master and Easy versions prior to 6.36 Description The issue allows remote attackers to execute arbitrary commands via an unrestricted file upload in the Panel Designer dashboard. This can be exploited by logging into the administrat...

Avaya Call Management System 安全漏洞

Avaya Call Management System is an integrated analytics and reporting solution from Avaya, Inc. that keeps you informed about virtually everything. A security vulnerability exists in Avaya Call Management System version 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0, which stems from...

CVE-2025-46612

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...

CVE-2025-46612: Unrestricted Upload of File with Dangerous Type

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...

CVE-2025-46612

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...

CVE-2025-1041: Improper Input Validation

An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0...

CVE-2025-49004 Hijacking Caido instance during the initial setup via DNS Rebinding to achieve RCE

Caido is a web security auditing toolkit. Prior to version 0.48.0, due to the lack of protection for DNS rebinding, Caido can be loaded on an attacker-controlled domain. This allows a malicious website to hijack the authentication flow of Caido and achieve code execution. A malicious website load...