CVE-2012-4673

SQL injection vulnerability in application/controllers/invoice.php in NeoInvoice might allow remote attackers to execute arbitrary SQL commands via vectors involving the sortcol variable in the listitems function, a different vulnerability than CVE-2012-3477...

The vulnerability of the API component of the Zabbix monitoring system allows a attacker to execute arbitrary commands.

The vulnerability of the API component of the Zabbix monitoring system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary commands by processing the groupBy parameter...

The vulnerability of the microprogrammed control panel software for Honeywell MB-Secure and MB-Secure PRO devices arises from the lack of measures taken to neutralize special elements used in the operating system’s command sequence. This allows attackers to execute arbitrary commands with elevated privileges.

The vulnerability of the microprogrammed control panel software for Honeywell MB-Secure and MB-Secure PRO devices is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute...

CVE-2025-44872

Tenda AC9 V15.03.06.42multi was found to contain a command injection vulnerability in the formsetUsbUnload function via the deviceName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

The vulnerability of the telnet CLI service in NETGEAR’s integrated software routers FVS336Gv2 and FVS336Gv3 allows a hacker to execute arbitrary commands with root privileges.

The vulnerability of the telnet CLI service in NETGEAR’s integrated router software products like FVS336Gv2 and FVS336Gv3 exists due to the lack of measures to neutralize specific components. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges...

Malicious code in @nationalgeographicsociety/ngsui-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2e0774a528586e00ee067cc42c7701529d5ea60809590ae156b473dffb95b4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in architecture-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4282b66b0052ca80f8717181dbf7b0b94e88433b9e37f9ae718531960f9ddcbd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in com.unity.performance.profile-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0af641db458fc7a8378ef6660e94aa21d6e8a8662aa90cc72412d909765b39d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in foundry-js-react-blueprint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 003370478f168f2d57cb08caf6214ba25adf57eaefa736fc7460dd4550ee09c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in limit-order-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7ad6cba9faf323fb0ffae19f703ba40944f39673b2e8803037d19ff0990671f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Thousands of WordPress Websites Infected with Malware

The malware includes four separate backdoors: Creating four backdoors facilitates the attackers having multiple points of re-entry should one be detected and removed. A unique case we haven't seen before. Which introduces another type of attack made possibly by abusing websites that don't monitor...

Linux Distros Unpatched Vulnerability : CVE-2014-9235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple SQL injection vulnerabilities in Zoph aka Zoph Organizes Photos 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands vi...

Mercury MIPC552W 安全漏洞

Mercury MIPC552W is a webcam from Mercury China. A security vulnerability exists in Mercury MIPC552W v1.0, which stems from a lack of length validation and a buffer overflow vulnerability that could cause the remote target device to crash or execute arbitrary commands...

CVE-2024-55580

An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. Unprivileged users with network access may be able to execute remote commands that could cause high availability damages, including high integrity and confidentiality risks. This is fixed in November 2024 IR, Ma...

CVE-2025-22611

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to escalate his or any other team members privileges to any role, including the owner role. He's also able t...

PT-2025-3849 · Nec · Aterm Wx3600Hp +1

Name of the Vulnerable Software and Affected Versions: NEC Corporation Aterm WX1500HP versions 1.4.2 and earlier NEC Corporation Aterm WX3600HP versions 1.5.3 and earlier Description: The issue allows an attacker to execute arbitrary OS commands via the network. This can be done through the...

Four-Faith F3x24和Four-Faith F3x36 安全漏洞

The Four-Faith F3x24 and Four-Faith F3x36 are both portable wireless mobile routers from Four-Faith China. A security vulnerability exists in the Four-Faith F3x24 and Four-Faith F3x36. The vulnerability can be exploited to execute arbitrary operating system commands over HTTP while changing the...

Vulnerabilities fixed in Qlik Sense Enterprise for Windows

Qlik has fixed vulnerabilities in Qlik Sense Enterprise for Windows for versions before November 2024 IR. The vulnerabilities are in the way Qlik Sense Enterprise handles network access for non-privileged users. These users can create connection objects that can execute arbitrary EXE files, leadi...

CVE-2024-55580

An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. Unprivileged users with network access may be able to execute remote commands that could cause high availability damages, including high integrity and confidentiality risks. This is fixed in November 2024 IR, Ma...

Malicious code in cdp-agentkit-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eca0429e104094162231b21ae70c94d199a4c5c2d25813c0eb807d94d7079973 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...