CVE-2025-58180

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename...

Advisory ROSA-SA-2025-2971

software: less 608 WASP: ROSA-CHROME unaffected versions = less-608-3 affected versions less-608-3 CVE-ID: CVE-2024-32487 BDU-ID: 2024-03717 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the UNIX-like UNIX text terminal utility Less is related to incorrect handling of quotation marks in the...

CVE-2025-41701: Deserialization of Untrusted Data

An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool. These arbitrary commands are executed in the user context...

D-Link DIR-823X 命令注入漏洞

The D-Link DIR-823X is a wireless router from China's AUO D-Link. The D-Link DIR-823X suffers from a command injection vulnerability due to a flaw in the sub415028 function in the goform/setsticleases file. An attacker can exploit the vulnerability to execute arbitrary commands on the system...

CVE-2025-58180: Improper Neutralization of Special Elements used in an OS Command

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename...

CVE-2025-58444

The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redirect URI. This could be leveraged to...

PT-2025-36620

An XSS issue was reported in the MCP Inspector local development tool when connecting to an untrusted remote MCP server with a malicious redirect URI. This could be leveraged to interact directly with the inspector proxy to trigger arbitrary command execution. Users are advised to update to 0.16....

MCP inspector 安全漏洞

MCP inspector is a development tool for debugging MCP servers. A security vulnerability exists in MCP inspector versions prior to 0.16.6 that stems from a cross-site scripting attack that could lead to arbitrary command execution...

CVE-2025-58444: Improper Neutralization of Encoded URI Schemes in a Web Page

The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redirect URI. This could be leveraged to...

The vulnerability of the configuration management system and the remote execution of operations, Salt, is related to the lack of measures for cleaning input data. This allows attackers to increase their privileges and execute arbitrary commands.

The vulnerability of configuration management systems and remote execution of operations related to Salt is related to the lack of measures for cleaning input data. Exploiting this vulnerability can allow attackers to increase their privileges and execute arbitrary commands...

CVE-2025-58370

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent was configured to auto-approve execution of...

CVE-2025-50755

Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsyscmd function via the command parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

The vulnerability of the soapcgi_main() function in the SOAP Service component of the soap.cgi file from the D-Link DIR-852 router’s software, allowing a hacker to execute arbitrary commands.

The vulnerability of the soapcgimain function in the SOAP Service component of the soap.cgi file from the D-Link DIR-852 router’s software lies in the lack of data cleaning measures at the control level when processing the service parameter. Exploiting this vulnerability allows an attacker to...

CVE-2025-50757

Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsysadm function via the username parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-58178

SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. In versions 4 to 5.3.0, a command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to be processed without proper...

EUVD-2025-26404

Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsysadm function via the username parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

WAVLINK WN535K3 安全漏洞

WAVLINK WN535K3 is a wireless router from China Ruiyin WAVLINK. A security vulnerability exists in the Wavlink WN535K3 version 20191010, which stems from the improper handling of the command parameter in the setsyscmd function, which could lead to the execution of arbitrary commands...

SonarQube Server 命令注入漏洞

SonarQube Server is a code quality and security auditing platform from Sonar UK. A command injection vulnerability exists in SonarQube Server versions 4 through 5.3.0, which stems from SonarQube Scan GitHub Action command injection and could lead to the execution of arbitrary commands...

CVE-2025-50755

The Wavlink WN535K3 wireless router (version 20191010 ) is vulnerable to a command injection vulnerability within the set_sys_cmd function. The flaw is triggered via the command parameter, allowing an attacker to execute arbitrary commands by sending a crafted request. As a temporary workaround, ...

TRENDnet TV-IP410 Command Injection Vulnerability

TRENDnet TV-IP410 is an Internet TV from TRENDnet. The TRENDnet TV-IP410 suffers from a command injection vulnerability that stems from misuse of the parameter DeviceURL in the file uapply.cgi of the component httpd, which can be exploited by an attacker to cause arbitrary command execution...