CVE-2013-10052 ZPanel zsudo Local Privilege Escalation

ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw enables local attackers with shell...

CVE-2013-10052

CVE-2013-10052 concerns ZPanel’s zsudo helper. A misconfiguration in /etc/sudoers lets low-privilege users run arbitrary commands as root, enabling local privilege escalation by writing a payload to a writable dir and executing it via zsudo. Documented impact includes post-exploitation scenarios ...

CVE-2013-10052 ZPanel zsudo Local Privilege Escalation

ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw enables local attackers with shell...

CVE-2025-36604

Summary (CVE-2025-36604) Dell UnityVSA prior to 5.5.1 is affected by an unauthenticated remote OS command injection vulnerability. The Nuclei template and associated notes describe a pre-auth command execution path affecting Dell UnityVSA

CVE-2025-36604

Dell Unity, versions 5.5 and prior, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution...

CVE-2025-36604

Dell Unity, versions 5.5 and prior, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution...

CVE-2025-54133

Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP Model Context Protocol deeplink handler, allowing attackers to execute 2-click arbitrary system commands through social engineering attacks. When...

CVE-2025-54131

Cursor is a code editor built for programming with AI. In versions below 1.3, an attacker can bypass the allow list in auto-run mode with a backtick or $cmd. If a user has swapped Cursor from its default settings requiring approval for every terminal call to an allowlist, an attacker can execute...

CVE-2013-10059

An authenticated OS command injection vulnerability exists in various D-Link routers tested on DIR-615H1 running firmware version 8.04 via the toolsvct.htm endpoint. The web interface fails to sanitize input passed from the pingipaddr parameter to the toolsvct.htm diagnostic interface, allowing...

PT-2025-31809

Name of the Vulnerable Software and Affected Versions Dell Unity versions prior to 5.5.1 Dell UnityVSA versions prior to 5.5.1 Description Dell Unity and UnityVSA contain an Improper Neutralization of Special Elements used in an OS Command vulnerability, also known as OS Command Injection. An...

D-Link DI-7300G+ Router Proxy Client Command Execution

The vulnerability of the proxyclient.asp script in the D-Link DI-7300G+ router microprogramming system is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary command...

CVE-2013-10052: Improper Privilege Management

ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw enables local attackers with shell...

Dell PowerProtect Data Domain operating system command injection vulnerability

Dell PowerProtect Data Domain Dell PowerProtect DD is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell, USA. A security vulnerability exists in Dell PowerProtect Data Domain, which can be exploited by an attacker to cause arbitrary commands to be...

Dell PowerProtect Data Domain operating system command injection vulnerability

Dell PowerProtect Data Domain Dell PowerProtect DD is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell, USA. A security vulnerability exists in Dell PowerProtect Data Domain, which can be exploited by an attacker to cause arbitrary commands to be...

Dell Unity operating system command injection vulnerability

Dell Unity is a set of virtual Unity storage environments from Dell USA. An operating system command injection vulnerability exists in Dell Unity 5.5 and prior versions, which stems from the svcnfssupport utility failing to properly filter construct command special characters, commands, etc. An...

WeGIA web manager Arbitrary Command Execution

The vulnerability of the WeGIA web manager exists due to the lack of measures taken to neutralize special elements during the processing of the branch parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with user privileges of the web server www-data...

CVE-2025-52361

Insecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0.16 Build 2023-03-13 allows a locally authenticated low-privilege user to execute arbitrary commands with root privilege via editing this script which is executed with root-privileges on any interaction...

CVE-2013-10039

A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ipcheckhost.cgi. Crafted input to the 'ip' parameter allows attackers to execute arbitrary shell commands on the server via embedded base64-encoded payloads. Authentication may be required depending on deploymen...

Arbitrary Command Injection

Overview @nestjs/devtools-integration is a Nest - modern, fast, powerful node.js web framework @devtools-integration Affected versions of this package are vulnerable to Arbitrary Command Injection via the inspector/graph/interact endpoint, which accepts JSON input containing a code field and...

CVE-2025-54133

Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP Model Context Protocol deeplink handler, allowing attackers to execute 2-click arbitrary system commands through social engineering attacks. When...