CVE-2025-41701: Deserialization of Untrusted Data

An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool. These arbitrary commands are executed in the user context...

D-Link DIR-823X command injection vulnerability

The D-Link DIR-823X is a wireless router from China's AUO D-Link. The D-Link DIR-823X suffers from a command injection vulnerability due to a flaw in the sub415028 function in the goform/setsticleases file. An attacker can exploit the vulnerability to execute arbitrary commands on the system...

CVE-2025-58180: Improper Neutralization of Special Elements used in an OS Command

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename...

CVE-2025-58444

The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redirect URI. This could be leveraged to...

CVE-2025-58444: Improper Neutralization of Encoded URI Schemes in a Web Page

The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redirect URI. This could be leveraged to...

MCP Inspector security vulnerabilities

MCP inspector is a development tool for debugging MCP servers. A security vulnerability exists in MCP inspector versions prior to 0.16.6 that stems from a cross-site scripting attack that could lead to arbitrary command execution...

PT-2025-36620

An XSS issue was reported in the MCP Inspector local development tool when connecting to an untrusted remote MCP server with a malicious redirect URI. This could be leveraged to interact directly with the inspector proxy to trigger arbitrary command execution. Users are advised to update to 0.16....

Salt Configuration Management Privilege Escalation Command Injection

The vulnerability of configuration management systems and remote execution of operations related to Salt is related to the lack of measures for cleaning input data. Exploiting this vulnerability can allow attackers to increase their privileges and execute arbitrary commands...

CVE-2025-58370

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent was configured to auto-approve execution of...

CVE-2025-50755

Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsyscmd function via the command parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

SOAP Service Command Execution

The vulnerability of the soapcgimain function in the SOAP Service component of the soap.cgi file from the D-Link DIR-852 router’s software lies in the lack of data cleaning measures at the control level when processing the service parameter. Exploiting this vulnerability allows an attacker to...

CVE-2025-50757

Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsysadm function via the username parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-58178

SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. In versions 4 to 5.3.0, a command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to be processed without proper...

WAVLINK WN535K3 has security vulnerabilities

WAVLINK WN535K3 is a wireless router from China Ruiyin WAVLINK. A security vulnerability exists in the Wavlink WN535K3 version 20191010, which stems from the improper handling of the command parameter in the setsyscmd function, which could lead to the execution of arbitrary commands...

TRENDnet TV-IP410 Command Injection Vulnerability

TRENDnet TV-IP410 is an Internet TV from TRENDnet. The TRENDnet TV-IP410 suffers from a command injection vulnerability that stems from misuse of the parameter DeviceURL in the file uapply.cgi of the component httpd, which can be exploited by an attacker to cause arbitrary command execution...

WAVLINK WN535K3 has security vulnerabilities

WAVLINK WN535K3 is a wireless router from China Ruiyin WAVLINK. A security vulnerability exists in the Wavlink WN535K3 version 20191010, which stems from the improper handling of the username parameter in the setsysadm function, which could lead to the execution of arbitrary commands...

CVE-2025-50755

The Wavlink WN535K3 wireless router (version 20191010 ) is vulnerable to a command injection vulnerability within the set_sys_cmd function. The flaw is triggered via the command parameter, allowing an attacker to execute arbitrary commands by sending a crafted request. As a temporary workaround, ...

EUVD-2025-26404

Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsysadm function via the username parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

SonarQube Server command injection vulnerability

SonarQube Server is a code quality and security auditing platform from Sonar UK. A command injection vulnerability exists in SonarQube Server versions 4 through 5.3.0, which stems from SonarQube Scan GitHub Action command injection and could lead to the execution of arbitrary commands...

Dell Unity OE Privilege Escalation Command Execution

The vulnerability of the Dell Unity Operating Environment’s operating environment for data storage management and operation is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow attackers to enhance...