3068 matches found
CVE-2025-57567
A remote code execution RCE vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory /themes/defaut/css/minify.php. An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel,...
Command Injection
Hoverfly is vulnerable to Command Injection. The vulnerability is due to improper input validation in the middleware endpoint due to the binary and script parameters being passed directly into a system without sanitization. This allows an attacker to supply crafted values for those parameters to...
PT-2025-42535
Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.8 Description Bagisto is susceptible to Server-Side Template Injection SSTI because user-provided input isn't properly sanitized when processing product descriptions with the server-side templating engine. An...
CVE-2025-59051
The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command...
CVE-2025-59481
A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell tmsh command that may allow an authenticated attacker with at least resource administrator role to execute arbitrary system commands with higher privileges. A successful exploit can allow the attacker to cross a security...
CVE-2025-59481
CVE-2025-59481 describes a vulnerability in BIG-IP iControl REST and TMOS Shell (tmsh) that allows an authenticated attacker with at least Resource Administrator privileges to execute arbitrary system commands with elevated privileges, potentially crossing a security boundary. Affected products/v...
CVE-2025-61941
A path traversal issue exists in WXR9300BE6P series firmware versions prior to Ver.1.10. Arbitrary file may be altered by an administrative user who logs in to the affected product. Moreover, arbitrary OS command may be executed via some file alteration...
EUVD-2025-34529
A path traversal issue exists in WXR9300BE6P series firmware versions prior to Ver.1.10. Arbitrary file may be altered by an administrative user who logs in to the affected product. Moreover, arbitrary OS command may be executed via some file alteration...
PT-2025-42345
Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to the fixed version Description A security issue exists in the iControl REST and BIG-IP TMOS Shell tmsh command that could allow an authenticated attacker with resource administrator privileges to execute arbitrary...
CVE-2025-60013: Improper Neutralization of Special Elements used in an OS Command
When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, arbitrary system commands may be executed, and the FIPS hardware security module HSM may fail to initialize. A successful exploit can allow the...
CVE-2025-58325
An Incorrect Provision of Specified Functionality vulnerability CWE-684 in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may allow a local authenticated attacker to execute system commands via crafted CLI commands...
CVE-2025-0636
EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited leading to Arbitrary Code Execution...
PT-2025-41917
Name of the Vulnerable Software and Affected Versions Rockwell Automation Driver Package x64 affected versions not specified Description A security issue exists in the Rockwell Automation Driver Package x64 Microsoft Installer File MSI repair functionality, installed with FTLinx. An authenticated...
CVE-2025-58325: Incorrect Provision of Specified Functionality
An Incorrect Provision of Specified Functionality vulnerability CWE-684 in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may allow a local authenticated attacker to execute system commands via crafted CLI commands...
CVE-2025-0636
EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited leading to Arbitrary Code Execution...
Ericsson RAN Compute和Ericsson Site Controller 6610 安全漏洞
Ericsson RAN Compute and Ericsson Site Controller 6610 are both products of Ericsson, a Swedish company.Ericsson RAN Compute is a cloud-native software solution for handling computing functions in a RAN.Ericsson Site Controller 6610 is an intelligent power management controller for site...
CVE-2025-53967
Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl command. The vulnerable endpoint fails to properly sanitize...
EUVD-2018-3018
Malware in sbrugna...