Sapido多款产品 操作系统命令注入漏洞

Sapido BR270n and others are products of Sapido Inc.Sapido BR270n is a wireless router.Sapido BR071n is a router.Sapido BR261c is a router. An operating system command injection vulnerability exists in several Sapido products.The vulnerability stems from OS command injection and could lead to the...

Elecom WRH-733GBK和Elecom WRH-733GWH 操作系统命令注入漏洞

The Elecom WRH-733GBK and Elecom WRH-733GWH are both portable routers from Elecom Japan. The Elecom WRH-733GBK and Elecom WRH-733GWH suffer from an operating system command injection vulnerability that stems from telnet function command injection leading to arbitrary OS command execution...

VulnCheck KEV: CVE-2025-34041

An OS command injection vulnerability exists in the Chinese versions of Sangfor Endpoint Detection and Response EDR management platform versions 3.2.16, 3.2.17, and 3.2.19. The vulnerability allows unauthenticated attackers to construct and send malicious HTTP requests to the EDR Manager interfac...

The vulnerability of the `easy_uci_set_option_string_0()` function in the `/cgi-bin/lighttpd.cgi` file of the LB-LINK BL-AC3600 router’s microprogramming system allows a hacker to execute arbitrary code.

The vulnerability of the easyucisetoptionstring0 function in the /cgi-bin/lighttpd.cgi file of the LB-LINK BL-AC3600 router microprogramming system is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability could allow an attacker operating...

CVE-2025-34029

An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler. The /goform/formSysCmd endpoint exposes a system command interface through the sysCmd parameter. A remote authenticated attacker can submit arbitrary shell...

CVE-2025-34030 sar2html OS Command Injection

An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject shell commands by appending them to t...

The vulnerability of the Adobe Experience Manager (AEM) content and media data management system lies in the insufficient protection of website structures, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the plugin “Import from XML, YML, JSON. Uploading product catalogs for 1C-Bitrix” allows a perpetrator to execute arbitrary commands.

The vulnerability of the plugin “Import from XML, YML, JSON. Uploading product catalogs for 1C-Bitrix” is related to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the Adobe Experience Manager content and media data management system, related to the lack of measures taken to protect the website structure, allows a perpetrator to execute arbitrary code.

The vulnerability of the Adobe Experience Manager content and media data management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the Adobe Experience Manager (AEM) content and media data management system lies in the insufficient protection of website structures, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the Chamilo LMS electronic learning and content management system lies in the lack of measures to neutralize special elements used within the operating system, allowing attackers to execute arbitrary SQL queries.

The vulnerability of the Chamilo LMS, a system for electronic teaching and content management, lies in the lack of measures taken to neutralize special elements used in the operating system. Exploiting this vulnerability could allow a malicious actor to execute arbitrary SQL queries remotely...

The vulnerability of the iTop web tool for managing IT services arises from the lack of measures to neutralize special elements, allowing attackers to execute arbitrary code.

The vulnerability of the iTop IT service management web tool is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the IBM i operating system, related to an uncontrolled element in the search process, allows a perpetrator to execute arbitrary code with administrator privileges.

The vulnerability of the IBM i operating system is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

📄 Skyvern 0.1.85 Remtoe Code Execution / SSTI

Skyvern version 0.1.85 suffers from a remote code execution vulnerability via server-side template injection. Exploit Title: Skyvern 0.1.85 - Remote Code Execution RCE via SSTI Date: 2025-06-15 Exploit Author: Cristian Branet Vendor Homepage: https://www.skyvern.com/ Software Link:...

Astra Linux – Vulnerability in GIMP

GIMP XWD File Parsing: Integer Overflow and Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a...

D-Link DIR-619L 安全漏洞

The D-Link DIR-619L is a wireless router from China-based AUO D-Link. A buffer overflow vulnerability exists in the D-Link DIR-619L version 2.06B01, which stems from the formmacfilter method failing to properly validate the length size of the input data, and can be exploited by a remote attacker ...

The vulnerability of the “Termide Virtual Desktops Connection Manager” software server, related to errors in user permission separation, allows a perpetrator to execute arbitrary commands.

The vulnerability of the “Termide Virtual Desktops Connection Manager” software suite is related to errors in user permission allocation. Exploiting this vulnerability allows a malicious actor to remotely execute commands like qemu-monitor...

ROS-20250616-09

Vulnerability in adodb library is due to improper escaping of query parameter. Exploitation exploitation of the vulnerability could allow a remote attacker to execute arbitrary SQL statements...

CVE-2025-41662

An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of Cross-Site Request Forgery CSRF protection in the Main Web Interface endpoint tlsiotgensetting...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration, and remote execution application from the Salt project. A security vulnerability exists in Salt that stems from not properly authenticating the caller, which could lead to an authentication bypass...