EUVD-2025-199741

An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to execute arbitrary commands remotely...

Zenitel TCIV-3+ operating system command injection vulnerability

The Zenitel TCIV-3+ is an IP intercom terminal from Zenitel Norway. An operating system command injection vulnerability exists in the Zenitel TCIV-3+ prior to version 9.3.3.0, which stems from insufficient user input cleanup and could allow an unauthenticated attacker to remotely execute arbitrar...

WordPress plugin Sneeit Framework has a code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code injection...

REDAXO security vulnerabilities

REDAXO is a content management system from REDAXO open source. A security vulnerability exists in REDAXO version 5.20.0, which stems from a template management component that allows injection of PHP code, potentially leading to remote code execution...

Zoho ManageEngine Analytics Plus SQL Injection

The vulnerability of the Zoho ManageEngine Analytics Plus software is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

Elliptic cryptographic library Node.js Code Execution

The vulnerability of the truncateToN function in the Elliptic cryptographic library of the Node.js software platform is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Trend Micro Endpoint Encryption ValidateToken Code Execution

The vulnerability of the ValidateToken function in the PolicyServer server, a component of the Trend Micro Endpoint Encryption TMEE data encryption tool, is related to the use of outdated functions. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code...

CVE-2025-12740 Remote Command Execution in Looker via IBM DB2 JDBC drive

A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious command, due to inadequate filtering of the driver's parameters. Looker-hosted and Self-hosted were found to be vulnerable. This issue has...

Important: gimp security update

The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: GIMP DCM...

EUVD-2025-198570

A vulnerability was determined in D-Link DIR-822K and DWR-M920 1.0020250513164613/1.1.50. Impacted is an unknown function of the file /boafrm/formVpnConfigSetup. Executing manipulation of the argument submit-url can lead to buffer overflow. The attack can be executed remotely. The exploit has bee...

Updated konsole packages fix security vulnerability

KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code...

Command Execution Vulnerability in DH2100+ NAS of Shenzhen Greenlink Technology Co.

The DH2100+ NAS is a two-drive network attached storage device designed for home and personal users. A command execution vulnerability exists in the Shenzhen Greenlink DH2100+ NAS, which can be exploited by attackers to remotely execute commands...

CVE-2025-34328

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component F2MAdmin that exposes an unauthenticated script-management endpoint at AudioCodesfiles/utils/IVR/diagram/ajaxScript.php. The saveScript action writes attacker-supplie...

CVE-2025-13445

A flaw has been found in Tenda AC21 16.03.08.16. This affects an unknown part of the file /goform/SetIpMacBind. Executing a manipulation of the argument list can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used...

SAP Starter Solution SQL Injection

The vulnerability of the tax management and accounting solution for small and medium-sized enterprises, SAP Starter Solution PL SAFT, is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL querie...

Corporate web application SQL Injection

The vulnerability of the corporate web application for interaction between contractors in BEIMS Contractor Web involves insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...

CVE-2025-41734

An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices...

Exploit for Code Injection in Gitlab

Vuln Impact An issue has been discovered in GitLab CE/EE af...

Exploit for CVE-2021-1675

CVE-2021-1675 / CVE-2021-34527 Impacket implementation of the...

Emby Server < 4.8.1.0 XSS Vulnerability

Emby Server is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...