CVE-2025-44848

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44842

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44839

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the magicid parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44861

CVE-2025-44861 affects TOTOLINK CA300-POE (V6.2c.884_B20180522). A vulnerability in the CloudSrvUserdataVersionCheck function allows remote code execution via the url parameter, enabling arbitrary commands through a crafted request. Public references describe this as a command-injection vulnerabi...

CVE-2025-44840

TOTOLINK CA600-PoE vulnerable due to a command injection in the CloudSrvUserdataVersionCheck function via the svn parameter on version 5.3c.6665_B20180820. This allows an attacker to execute arbitrary commands through a crafted request. A practical remediation from PT-2025-18661 suggests disablin...

CVE-2025-44845

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44842

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44836

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44838

The CVE-2025-44838 affects TOTOLINK CPE CP900 (version 6.3c.1144_B20190715). A command injection exists in the setUploadUserData function via the FileName parameter, enabling arbitrary command execution on crafted requests. Public sources in connected documents corroborate the vulnerability and d...

CVE-2025-44863

TOTOLINK CA300-POE (V6.2c.884_B20180522) contains a command injection in the msg_process function via the Url parameter, allowing arbitrary command execution through a crafted request (CVE-2025-44863). The CVSS v3.1 base score is 6.5 (Network, Low attack complexity, No privileges, User interactio...

CVE-2025-44841

Summary of CVE-2025-44841 : TOTOLINK CA600-PoE (V5.3c.6665_B20180820) contains a command injection vulnerability in the CloudSrvUserdataVersionCheck function, exploitable via the version parameter. The vulnerability allows an attacker to execute arbitrary commands through a crafted request (attac...

CVE-2025-44866

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44862

Summary : CVE-2025-44862 affects TOTOLINK CA300-POE (V6.2c.884_B20180522). A command injection flaw exists in the recvUpgradeNewFw function via the fwUrl parameter, allowing execution of arbitrary commands through a crafted request. Documents identify the vulnerability and affected component but ...

CVE-2025-44840

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44836

CVE-2025-44836 concerns TOTOLINK CPE CP900 (version 6.3c.1144_B20190715). Multiple sources confirm a command injection vulnerability in the setApRebootScheCfg function, exploitable via the hour or minute parameters. The underlying issue is inadequate filtering of constructed command characters, e...

CVE-2025-24351

The CVE-2025-24351 entry affects the ctrlX OS web application’s “Remote Logging” functionality. A remote authenticated (low-privileged) attacker can execute arbitrary OS commands in the context of user “root” via a crafted HTTP request. Reports consistently describe this as a root-level command e...

CVE-2025-24351

A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated low-privileged attacker to execute arbitrary OS commands in the context of user “root” via a crafted HTTP request...

Amazon Linux AMI : ctags (ALAS-2025-1974)

The version of ctags installed on the remote host is prior to 5.8-2.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2025-1974 advisory. A flaw was found in Exuberant Ctags in the way it handles the -o option. This option specifies the tag filename. A crafted tag filenam...

Insecure Deserialization

LLaMA-Factory is vulnerable to Insecure Deserialization. The vulnerability is due to insecure deserialization causing because of the use of torch.load on untrusted .bin files, allowing arbitrary command execution during deserialization...

Important: ctags

Issue Overview: A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags in sort.c calls...