Cleo Harmony Permission Command Execution

The vulnerabilities of the software platforms Cleo Harmony, VLTrader, and LexiCom are related to errors in the use of standard permissions. Exploiting these vulnerabilities can allow a remote attacker to execute arbitrary commands...

Tenda G3 Form Set USB Partition Umount Command Execution

The vulnerability of the formSetUSBPartitionUmount function in the wireless access point Tenda G3 software is related to the lack of measures taken to neutralize special elements during the processing of the usbPartitionName parameter. Exploiting this vulnerability allows a remote attacker to...

CVE-2023-23356: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands. We have already fixed the vulnerability in the following versions:...

Ruijie Reyee OS MQTT Broker Arbitrary Command Execution

The vulnerability of the MQTT broker operating system in Ruijie Reyee OS is related to improper handling of insufficient permissions or privileges. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

NUUO NVRmini Devices OS Command Injection Vulnerability

NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command...

I-O Data Device UD-LT1/EX Arbitrary Command Execution

The vulnerability of the I-O Data Device UD-LT1 and UD-LT1/EX router microprogramming systems exists due to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2024-53376

CyberPanel versions prior to 2.3.8 are vulnerable to an OS command injection vulnerability. This flaw exists in the /websites/submitWebsiteCreation URI, where the application fails to neutralize shell metacharacters in the phpSelection field. An authenticated remote attacker can exploit this by s...

Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer

...

PT-2024-36552 · Unknown · Crater Invoice

Name of the Vulnerable Software and Affected Versions: Crater Invoice affected versions not specified Description: A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP KEY to achieve remote command execution on the server by manipulating the laravel sessi...

Dell Avamar SQL Injection Vulnerability (CNVD-2025-18250)

Dell Avamar is a software solution for data backup and recovery. A SQL injection vulnerability exists in Dell Avamar. The vulnerability stems from an improper neutralization of special elements in SQL commands. An attacker could exploit this vulnerability to perform command execution...

CyberPanel upgrademysqlstatus Privilege Escalation Command Execution

The vulnerability of the upgrademysqlstatus function in the CyberPanel web hosting control panel is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to elevate their privileges and execute arbitrary commands remotely...

Mitel 6869i Arbitrary Command Execution

The vulnerability of the Microprogrammed Software for Mitel 6869i IP phones lies in the lack of measures taken to sanitize data at the administrative level when processing parameters like username and path on the upgrade.html page. Exploiting this vulnerability allows a malicious actor to execute...

NETGEAR R7000 RMT_invite.cgi Command Execution

The vulnerability in the RMTinvite.cgi script of NETGEAR R7000 Wi-Fi routers lies in the lack of data cleaning at the control level when processing the parameter devicename2. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...

ROS-20241211-04

CREATE POLICY row-protected table security policy vulnerability in the PostgreSQL database management system PostgreSQL is related to a lack of consistency between independent views of shared state. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary...

CVE-2024-55547 Remote Command Execution via SNMP

SNMP objects in NET-SNMP used in ORing IAP-420 allows Command Injection. This issue affects IAP-420: through 2.01e...

CVE-2024-55547 Remote Command Execution via SNMP

SNMP objects in NET-SNMP used in ORing IAP-420 allows Command Injection. This issue affects IAP-420: through 2.01e...

CVE-2024-47977

Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this...

CVE-2024-47484

Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this...

HPESBNW04765 rev.1 - HPE Aruba Networking AirWave Management Platform, Multiple Vulnerabilities

Potential Security Impact: Remote: Arbitrary Command Execution, Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba AirWave Management Platform : Please, refer to the Vulnerability Summary above for affected versions Affected Products HPE Aruba Networking...

Image Access Scan2Net security vulnerability

Image Access Scan2Net is a scanning software from Image Access, Germany. A security vulnerability exists in Image Access Scan2Net versions 7.40 and earlier, 7.42 and earlier, and 7.42B and earlier, which stems from improper cleaning of the HTTP GET parameter data, which allows an attacker to acce...