CVE-2025-25894

An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the sambawg and sambanbn parameters. This vulnerability allows attackers to execute arbitrary operating system OS commands via a crafted packet...

CVE-2025-25893

An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the inIP, insPort, inePort, exsPort, exePort, and protocol parameters. This vulnerability allows attackers to execute arbitrary operating system OS commands via a crafted packet...

CVE-2021-46686

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in acmailer CGI ver.4.0.3 and earlier and acmailer DB ver.1.1.5 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker...

CVE-2025-25894

An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the sambawg and sambanbn parameters. This vulnerability allows attackers to execute arbitrary operating system OS commands via a crafted packet...

ChurchCRM security vulnerabilities

ChurchCRM is an open source CRM system built for churches by ChurchCRM Open Source. A security vulnerability exists in ChurchCRM version 5.13.0 and prior versions that stems from the newCountName parameter being directly connected to a SQL query without proper cleanup. An attacker exploiting this...

CVE-2025-25893

The D-Link DSL-3782 (version 1.01) is vulnerable to an OS command injection vulnerability. The root cause is the lack of measures to neutralize special elements used in operating system commands, specifically within the VirtualServer.asp CGI script. An attacker can exploit this by sending a craft...

D-Link DSL-3782 security vulnerability

The D-Link DSL-3782 is a wireless router from Taiwan, China-based D-Link. The D-Link DSL-3782 suffers from an OS command injection vulnerability that originates in the sambawg and sambanbn parameters, which can be exploited by an attacker to execute arbitrary commands...

NETGEAR FVS336G Command Injection Vulnerability

The NETGEAR FVS336G is a VPN Virtual Private Network firewall router from NETGEAR. The NETGEAR FVS336G suffers from a command injection vulnerability. The vulnerability stems from the application failing to properly filter constructed command special characters, commands, and so on. An attacker...

CVE-2021-46686

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in acmailer CGI ver.4.0.3 and earlier and acmailer DB ver.1.1.5 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker...

CVE-2021-46686

CVE-2021-46686 affects acmailer CGI (versions ≤ 4.0.3) and acmailer DB (versions ≤ 1.1.5). The issue is an OS command injection (CWE-78) due to improper neutralization of special elements in OS command handling, allowing an attacker to execute arbitrary commands on the affected system. Affected p...

FortiWeb web applications Command Execution

The vulnerability of the FortiWeb web application firewall software exists due to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands or code by sending specially crafted requests...

FortiWeb web applications Command Execution

The vulnerability of the software interface of FortiWeb web applications exists due to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands or code by sending specially crafted requests...

Fortinet FortiWeb OS Command Injection Vulnerability (CNVD-2025-03519)

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content...

Platform Management Interface Arbitrary Command Execution

The vulnerability of the platform’s management interface for deploying and managing LoadMaster applications is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially created HTTP request...

Platform Management Interface Arbitrary Command Execution

The vulnerability of the platform’s management interface for deploying and managing LoadMaster applications is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially created HTTP request...

CVE-2025-25067

mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands...

CVE-2025-0592

CVE-2025-0592 affects SICK Lector8xx and SICK InspectorP8xx devices. Multiple connected sources indicate a remote, low-privilege attacker can execute arbitrary shell commands by manipulating firmware files and uploading them to the device. Reported affected versions include SICK Lector8xx prior t...

CVE-2023-32007

UNSUPPORTED WHEN ASSIGNED The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in...

CVE-2024-35397

TOTOLINK CP900L v4.1.5cu.798B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

D-Link DIR-825 Router Command Execution

The vulnerability in the apcclientpin.cgi script of D-Link DIR-825 router microprogramming software exists due to the failure to implement measures to neutralize special elements used in the operating system’s command for processing the wpspin parameter. Exploiting this vulnerability allows a...