1819 matches found
EUVD-2023-0909
Malicious code in bioql PyPI...
EUVD-2022-52273
Malicious code in bioql PyPI...
EUVD-2023-44758
Malicious code in bioql PyPI...
EUVD-2023-43239
Malicious code in bioql PyPI...
EUVD-2025-18907
Malicious code in bioql PyPI...
EUVD-2025-21432
Malicious code in bioql PyPI...
EUVD-2025-21433
Malicious code in bioql PyPI...
GHSA-GXW4-4FC5-9GR5 figma-developer-mcp vulnerable to command injection in get_figma_data tool
Summary A command injection vulnerability exists in the figma-developer-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote...
PT-2025-40054
Framelink Figma MCP Server and Affected Versions Framelink Figma MCP Server versions prior to 0.6.3 Description The Framelink Figma MCP Server before version 0.6.3 contains a command injection flaw that allows an unauthenticated remote attacker to execute arbitrary operating system commands. This...
PT-2025-40046
Summary A command injection vulnerability exists in the figma-developer-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote...
CVE-2025-55211
FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated users of the Administrator Control Panel ACP can run arbitrary shell commands by maliciously changing languages of the framework module. This vulnerability is fixed in 17.0.21...
CVE-2025-55211
FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated users of the Administrator Control Panel ACP can run arbitrary shell commands by maliciously changing languages of the framework module. This vulnerability is fixed in 17.0.21...
CVE-2025-55211
FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated users of the Administrator Control Panel ACP can run arbitrary shell commands by maliciously changing languages of the framework module. This vulnerability is fixed in 17.0.21...
PT-2025-37763
Name of the Vulnerable Software and Affected Versions: FreePBX versions 17.0.19.11 through 17.0.20 Description: FreePBX is a web-based graphical user interface. Authenticated users of the Administrator Control Panel ACP can execute arbitrary shell commands by manipulating the framework module's...
FreePBX 操作系统命令注入漏洞
FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system via a GUI web-based graphical interface. An operating system command injection vulnerability exists in FreePBX version 17.0.19.11 through versions prior to...
Linux Distros Unpatched Vulnerability : CVE-2024-28335
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the...
Schneider Electric Saitel DR RTU 操作系统命令注入漏洞
The Schneider Electric Saitel DR RTU is a remote terminal device from Schneider Electric France. The Schneider Electric Saitel DR RTU suffers from an operating system command injection vulnerability that stems from improper neutralization of special elements, which could lead to the execution of...
CVE-2025-58358
Markdownify is a Model Context Protocol server for converting almost anything to Markdown. Versions below 0.0.2 contain a command injection vulnerability, caused by the unsanitized use of input parameters within a call to childprocess.exec, enabling an attacker to inject arbitrary system commands...
CVE-2025-58358 Markdownify is vulnerable to command injection through pptx-to-markdown tool
Markdownify is a Model Context Protocol server for converting almost anything to Markdown. Versions below 0.0.2 contain a command injection vulnerability, caused by the unsanitized use of input parameters within a call to childprocess.exec, enabling an attacker to inject arbitrary system commands...
CVE-2025-58358 Markdownify is vulnerable to command injection through pptx-to-markdown tool
Markdownify is a Model Context Protocol server for converting almost anything to Markdown. Versions below 0.0.2 contain a command injection vulnerability, caused by the unsanitized use of input parameters within a call to childprocess.exec, enabling an attacker to inject arbitrary system commands...