The vulnerability of the setWebWlanIdx function in the /lib/cste_modules/wireless.so file of the TOTOLINK A3100R router’s microprogramming system, which allows a attacker to execute arbitrary commands.

The vulnerability of the setWebWlanIdx function in the /lib/cstemodules/wireless.so module of the TOTOLINK A3100R router’s microprogramming system is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a...

HGiga iSherlock 操作系统命令注入漏洞

HGiga iSherlock is a series of software products from China Henderson HGiga. HGiga iSherlock suffers from an operating system command injection vulnerability that originates from OS command injection, which could allow a remote unauthorized attacker to execute arbitrary system commands...

GHSA-HPQF-M68J-2PFX js-object-utilities Vulnerable to Prototype Pollution

Vulnerability type: Prototype Pollution Affected Package: Product: js-object-utilities Version: 2.2.0 Remedy: Update package to version 2.2.1. Vulnerability Locations: js at module.exports /nodemodules/js-object-utilities/dist/set.js:16:29 Description: The latest version of js-object-utilities...

CVE-2021-47667

An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters in the tmpname parameter when dropping off a file via a POST /dropoff request...

The vulnerability of the sys_exec() function in the MariaDB database management system allows a attacker to execute arbitrary commands with elevated privileges.

The vulnerability of the sysexec function in the MariaDB database management system is related to improper code generation. Exploiting this vulnerability allows an attacker to execute arbitrary commands with elevated privileges...

The vulnerability of the Dell EMC Data Domain Operating System (DD OS) relates to deficiencies in access control, allowing attackers to enhance their privileges and execute arbitrary commands.

The vulnerability of the Dell EMC Data Domain Operating System DD OS is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges and execute arbitrary commands remotely...

CVE-2021-47667

The CVE-2021-47667 vulnerability affects ZendTo (versions 5.24-3 through 6.x before 6.10-7). It is an OS command injection in lib/NSSDropoff.php that allows unauthenticated remote attackers to run arbitrary commands via shell metacharacters in the tmp_name parameter during a POST /dropoff. Impact...

CVE-2025-0415

A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or partial denial of connectivity for...

CVE-2025-29987

Dell PowerProtect Data Domain with Data Domain Operating System DD OS versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root...

CVE-2025-29987

Dell PowerProtect Data Domain with DD OS prior to 8.3.0.15 is affected by an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could execute arbitrary commands with root privileges due to limited access-control granularity. The PT-2025-14...

Dell Unity OS Command Injection Vulnerability (CNVD-2025-06612)

Dell Unity is a set of virtual Unity storage environments from Dell USA. An OS command injection vulnerability exists in Dell Unity 5.4 and earlier versions, which can be exploited by an attacker to execute arbitrary operating system commands on the system...

Dell PowerProtect Data Domain 安全漏洞

Dell PowerProtect Data Domain is a data protection storage appliance from Dell Technologies, built on the Data Domain platform and designed for building a resilient foundation for networks and enabling rapid data recovery. An access control vulnerability exists in Dell PowerProtect Data Domain,...

Dell Unity OS Command Injection Vulnerability (CNVD-2025-06614)

Dell Unity is a set of virtual Unity storage environments from Dell USA. An OS command injection vulnerability exists in Dell Unity 5.4 and earlier versions, which can be exploited by an attacker to execute arbitrary operating system commands on the system...

CVE-2025-30004

Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user. This issue affects CompletePBX: all versions up to and prior to 5.2.35...

CVE-2025-2071

A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This vulnerability arises due to improper handling of untrusted input, which is passed direct...

CVE-2025-0415

A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or partial denial of connectivity for...

DEBIAN-CVE-2024-36465

A low privilege regular Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter...

CVE-2025-22941

A command injection vulnerability in the web interface of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary commands...

Dell Unity OS Command Injection Vulnerability (CNVD-2025-06620)

Dell Unity is a set of virtual Unity storage environments from Dell USA. An OS command injection vulnerability exists in Dell Unity 5.4 and earlier versions, which can be exploited by an attacker to execute arbitrary operating system commands on the system...

Zabbix SQL注入漏洞

Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring and application monitoring. A security vulnerability exists in Zabbix that stems from SQL injection in the API service, which could lead to execution of arbitrary SQ...