CVE-2025-8821

A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function RPsetBasic of the file /goform/RPsetBasic. The manipulation of the argument bssid leads to os command injection. The attack may be initiated remotely. The...

PT-2025-33121

Name of the Vulnerable Software and Affected Versions: TOTOLINK N350R version 1.2.3-B20130826 Description: A vulnerability exists in TOTOLINK N350R that allows for remote command injection. The issue affects unknown code within the /boafrm/formSysCmd file. Manipulation of this file can lead to th...

Spree Commerce security vulnerabilities

Spree Commerce is an e-commerce platform from Spree Open Source. A security vulnerability exists in Spree Commerce versions prior to 0.60.2 that stems from the search function not cleaning up inputs, which could lead to remote command execution...

CVE-2011-10019: Improper Control of Generation of Code

Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the searchsend parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute...

CVE-2011-10017: Improper Neutralization of Special Elements used in an OS Command

Snort Report versions 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts. These scripts fail to properly sanitize user input passed via the target GET parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no...

PT-2025-33088

Name of the Vulnerable Software and Affected Versions: Spreecommerce versions prior to 0.60.2 Description: Spreecommerce versions prior to 0.60.2 contain a remote command execution issue in the search functionality. The application does not properly sanitize input passed via the searchsend...

NVIDIA Triton Inference Server HTTP Service Input Validation Vulnerability

Triton Inference Server is a high-performance inference service engine developed by NVIDIA, designed for AI model deployment in production environments, with support for a variety of frameworks TensorFlow, PyTorch, ONNX, etc. and optimized inference performance for GPUs and CPUs. An input...

Snort Report Security Vulnerabilities

Snort Report is an inspection report management system from the Snort team. A security vulnerability exists in Snort Report versions prior to 1.3.2 that stems from the nmap.php and nbtscan.php scripts not being cleaned of user input, which could lead to remote command execution...

PT-2025-54695

Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the searchsend parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute...

Linksys RE6250 mod_form.so Command Execution

The vulnerability of the modform.so script for Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 routers lies in the lack of measures to neutralize specific elements. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...

Linksys Router Arbitrary Command Execution

The vulnerability of the setDFSSetting function in Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 routers lies in the lack of measures to neutralize special elements when processing parameters lanNetmask and lanIp. Exploiting this vulnerability allows an attacker to execute arbitrary...

Linksys Router RP_setBasic Command Execution

The vulnerability of the RPsetBasic function /goform/RPsetBasic of Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 routers lies in the lack of measures to neutralize special elements during the processing of the bssid parameter. Exploiting this vulnerability allows a remote attacker to...

Linksys RE6250 Cross-Platform Command Execution

The vulnerability of the uminspectcrossband function /goform/RPsetBasicAuto of the microprogrammed routing solutions Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 is related to the failure to neutralize special elements during the processing of the staticGateway parameter. Exploiting...

N-able N-Central Insecure Deserialization Vulnerability

N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution...

Cisco IOS XE Software Web Based Management Interface (cisco-sa-webui-multi-ARNHM4v6)

According to its self-reported version, Cisco IOS-XE Software is affected by multiple vulnerabilities. - A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker to perform an injection attack against an affected...

CVE-2025-8818

A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function setDFSSetting of the file /goform/setLan. The manipulation of the argument lanNetmask/lanIp leads to os command injection. The attack may be launched...

GHSA-Q355-H244-969H Komari vulnerable to Cross-site WebSocket Hijacking

Summary WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking CSWSH attacks against authenticated users Details https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/terminal.goL33-L35 Any third party website can send request...

Komari vulnerable to Cross-site WebSocket Hijacking

Summary WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking CSWSH attacks against authenticated users Details https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/terminal.goL33-L35 Any third party website can send request...

Linux Distros Unpatched Vulnerability : CVE-2023-52138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve...

GO-2025-3844 RatPanel can perform remote command execution without authorization in github.com/tnborg/panel in github.com/TheTNB/panel

RatPanel can perform remote command execution without authorization in github.com/tnborg/panel in github.com/TheTNB/panel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...