CVE-2025-44861

The TOTOLINK CA300-PoE wireless access point (firmware version V6.2c.884_B20180522 ) is susceptible to a command injection vulnerability within the CloudSrvUserdataVersionCheck function. The root cause is a lack of proper input validation and filtering for special characters within the url parame...

CVE-2025-44867

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44844

The TOTOLINK CA600-PoE (version V5.3c.6665_B20180820 ) contains a command injection vulnerability within the setUpgradeFW() function. The root cause is a failure to properly filter or sanitize special characters and commands in the FileName parameter during processing. A remote attacker can explo...

CVE-2025-44840

The TOTOLINK CA600-PoE outdoor wireless AP/CPE (specifically version V5.3c.6665_B20180820 ) is susceptible to a command injection vulnerability in the CloudSrvUserdataVersionCheck function. The flaw exists because the svn parameter fails to properly filter special characters and commands during p...

CVE-2025-44836

The TOTOLINK CPE CP900 router (specifically version V6.3c.1144_B20190715 ) is vulnerable to a command injection flaw within the setApRebootScheCfg function. The root cause is the lack of proper input cleaning and filtering for hour and minute parameters, which allows an intruder to execute arbitr...

CVE-2025-44867

The Tenda W20E router, specifically version V15.11.0.6 , is vulnerable to a command injection vulnerability (CWE-77) within the formSetNetCheckTools function. The root cause is the hostName parameter failing to correctly filter special characters and commands, which allows an attacker to execute ...

CVE-2025-24351

A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated low-privileged attacker to execute arbitrary OS commands in the context of user “root” via a crafted HTTP request...

CVE-2025-24351

The CVE-2025-24351 entry affects the ctrlX OS web application’s “Remote Logging” functionality. A remote authenticated (low-privileged) attacker can execute arbitrary OS commands in the context of user “root” via a crafted HTTP request. Reports consistently describe this as a root-level command e...

Amazon Linux AMI : ctags (ALAS-2025-1974)

The version of ctags installed on the remote host is prior to 5.8-2.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2025-1974 advisory. A flaw was found in Exuberant Ctags in the way it handles the -o option. This option specifies the tag filename. A crafted tag filenam...

Insecure Deserialization

LLaMA-Factory is vulnerable to Insecure Deserialization. The vulnerability is due to insecure deserialization causing because of the use of torch.load on untrusted .bin files, allowing arbitrary command execution during deserialization...

Important: ctags

Issue Overview: A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags in sort.c calls...

Arbitrary Command Injection

Overview aworld is an Ant Agent Package Affected versions of this package are vulnerable to Arbitrary Command Injection through the subprocess.run and subprocess.Popen functions in shelltool.py. This allows an attacker to inject malicious commands due to insufficient sanitization of user-supplied...

Planet UNI-NMS-Lite Trust Management Issues Vulnerability

Planet UNI-NMS-Lite is a universal network management system from PLANET China that monitors all deployed wired or wireless PoE industrial grade network devices. Planet UNI-NMS-Lite suffers from a trust management issue vulnerability that can be exploited by an attacker to submit a special reques...

Exploit for CVE-2025-50505

CVE-2025-50505 Unauthorized API Leads to Arbitrary Command Ex...

CVE-2025-29209

TOTOLINK X18 v9.1.0cu.2024B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub41105C function of cstecgi .cgi...

CVE-2025-31340

A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to perform arbitrary system commands by running a malicious file...

D-Link DIR-832x 0x41dda8 Function Code Injection Vulnerability

The D-Link DIR-832x is a wireless router from China's AUO D-Link. A code injection vulnerability exists in the D-Link DIR-832x, which stems from the function 0x41dda8 failing to properly filter construct command special characters, commands, etc. An attacker can exploit this vulnerability to...

D-Link DIR-832x 0x417234 Function Command Injection Vulnerability

The D-Link DIR-823X is a wireless router from China's AUO D-Link. The D-Link DIR-832x suffers from a command injection vulnerability that stems from the failure of function 0x417234 to correctly filter construct command special characters, commands, and so on. An attacker can exploit this...

Edimax BR-6478AC formDiskCreateGroup function command execution vulnerability

Edimax BR-6478AC is a dual-band Gigabit router from China Xunzhou Edimax. The Edimax BR-6478AC suffers from a command execution vulnerability that originates from the groupname parameter in /boafrm/formDiskCreateGroup failing to correctly filter construct command special characters, commands, etc...

PT-2025-18265 · Ctrlx Os · Ctrlx Os

Name of the Vulnerable Software and Affected Versions: ctrlX OS affected versions not specified Description: A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated low-privileged attacker to execute arbitrary OS commands in the conte...