WilderForge security vulnerabilities

WilderForge is a Wildermyth core module API open-sourced by WilderForge. A security vulnerability exists in WilderForge that stems from the improper use of user-controlled variables in GitHub Actions, which could lead to arbitrary command execution...

CVE-2025-49013: Improper Control of Generation of Code

WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue arises from unsafe usage of $ github.event.review.body and other user controlled variables directly inside shell script contexts in GitHub...

Quantenna Communications Quantenna Wi-Fi chipset security vulnerabilities

The Quantenna Communications Quantenna Wi-Fi chipset is a WiFi chip from Quantenna Communications, Inc. A security vulnerability exists in Quantenna Communications Quantenna Wi-Fi chipset version 8.0.0.28 and earlier, which originates from a command injection and could lead to arbitrary command...

CVE-2024-13087

A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version:...

CVE-2024-13087

CVE-2024-13087 affects QNAP QHora/Qurouter devices. A command injection flaw exists in the router OS, enabling a user with local network access and an administrator account to cause arbitrary code execution via the miro_webserver_lib_RunExecBash path (poor input validation). Impact is described a...

CVE-2025-48782 Soar Cloud HRD Human Resource Management System - Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the upload file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to execute arbitrary system commands via a malicious file...

Soar Cloud System, Soar Cloud HRD Human Resource Management System – Security Vulnerabilities

Soar Cloud System Soar Cloud HRD Human Resource Management System is a human resource management system from Soar Cloud System, Inc. of Taiwan, China. A security vulnerability exists in Soar Cloud System Soar Cloud HRD Human Resource Management System version 7.3.2025.0408 and prior versions, whi...

Tenda CP3 injection vulnerability

Tenda CP3 is a smart camera from Tenda, a Chinese company. A command injection vulnerability exists in Tenda CP3 version 11.10.00.2311090948, which stems from the failure of the function subF3C8C in the file apollo to correctly filter constructed command special characters, commands, and so on. A...

Cisco Unified Communications Manager Command Injection (cisco-sa-vos-command-inject-65s2UCYy)

According to its self-reported version, Cisco Unified Communications Manager is affected by a command injection vulnerability. - A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlyin...

CVE-2025-49008

Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of "escapeshellcmd" in "/components/codegit/traits/execute.php" allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable...

CVE-2025-49008: Improper Neutralization of Special Elements used in an OS Command

Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of escapeshellcmd in /components/codegit/traits/execute.php allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable version...

Power Hardware Management Console Privilege Bypass

The vulnerability of the Power Hardware Management Console HMC device is related to errors in privilege management. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

Atheos security vulnerabilities

Atheos is an open source browser-based self-hosted cloud IDE from Atheos. A security vulnerability exists in Atheos versions prior to 6.0.4, which stems from parameter injection and could lead to arbitrary command execution...

CVE-2025-20278

A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device as the root user. This vulnerability is due to improper validation of user-supplied...

Arbitrary Command Execution

github.com/cli/go-gh is vulnerable to Arbitrary command execution. The vulnerability is due to unsafe handling of GitHub-provided URLs, allowing an attacker-controlled GitHub Enterprise Server to replace HTTP URLs with local file paths that could be executed on the user's machine...

CVE-2025-4010 Arbitrary Command Injection in Netcom NTC-6200 & NWL-222

The Netcom NTC 6200 and NWL 222 series expose a web interface to be configured and set up by operators. Multiple endpoints of the web interface are vulnerable to arbitrary command injection and use insecure hardcoded passwords. Remote authenticated attackers can gain arbitrary code execution with...

PT-2025-23474 · Diviotec · Diviotec Professional Series

Name of the Vulnerable Software and Affected Versions: The Diviotec professional series affected versions not specified Description: The issue concerns the exposure of a web interface in the Diviotec professional series, where one endpoint is vulnerable to arbitrary command injection. Additionall...

CVE-2025-41385

An OS Command Injection issue exists in wivia 5 all versions. If this vulnerability is exploited, an arbitrary OS command may be executed by a logged-in administrative user...

CVE-2025-48938

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URL...

CVE-2025-48938

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URL...