11338 matches found
CVE-2025-44863: Improper Neutralization of Special Elements used in a Command
TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...
CVE-2025-44848
The TOTOLINK CA600-PoE outdoor wireless AP/CPE device, specifically version V5.3c.6665_B20180820 , is vulnerable to a command injection flaw in the msg_process function. The root cause is the lack of adequate filtering for special characters and commands within the Url parameter during request pr...
CVE-2025-44842
TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...
CVE-2025-44843
TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...
CVE-2025-44836
The TOTOLINK CPE CP900 router (specifically version V6.3c.1144_B20190715 ) is vulnerable to a command injection flaw within the setApRebootScheCfg function. The root cause is the lack of proper input cleaning and filtering for hour and minute parameters, which allows an intruder to execute arbitr...
CVE-2025-44838
The TOTOLINK CPE CP900 (specifically firmware version V6.3c.1144_B20190715 ) is vulnerable to a command injection flaw within the setUploadUserData function. The root cause is a lack of proper input sanitization or filtering for special characters when processing the FileName parameter. This allo...
CVE-2025-44865
Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...
CVE-2025-44837
The TOTOLINK CPE CP900 (firmware version V6.3c.1144_B20190715 ) is vulnerable to a command injection vulnerability within the CloudSrvUserdataVersionCheck function. The root cause is the lack of proper sanitization for input data when processing the url and magicid parameters. A remote attacker c...
CVE-2025-44863
The TOTOLINK CA300-POE wireless access point (version 6.2c.884_B20180522 ) contains a command injection vulnerability in the msg_process function. The root cause is the failure to correctly filter special characters and commands within the Url parameter. A remote attacker can exploit this by send...
CVE-2025-44848
TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...
CVE-2025-44864
Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...
CVE-2025-44839
TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the magicid parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...
CVE-2025-24351
The CVE-2025-24351 entry affects the ctrlX OS web application’s “Remote Logging” functionality. A remote authenticated (low-privileged) attacker can execute arbitrary OS commands in the context of user “root” via a crafted HTTP request. Reports consistently describe this as a root-level command e...
CVE-2025-24351
A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated low-privileged attacker to execute arbitrary OS commands in the context of user “root” via a crafted HTTP request...
Amazon Linux AMI : ctags (ALAS-2025-1974)
The version of ctags installed on the remote host is prior to 5.8-2.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2025-1974 advisory. A flaw was found in Exuberant Ctags in the way it handles the -o option. This option specifies the tag filename. A crafted tag filenam...
Insecure Deserialization
LLaMA-Factory is vulnerable to Insecure Deserialization. The vulnerability is due to insecure deserialization causing because of the use of torch.load on untrusted .bin files, allowing arbitrary command execution during deserialization...
Important: ctags
Issue Overview: A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags in sort.c calls...
Arbitrary Command Injection
Overview aworld is an Ant Agent Package Affected versions of this package are vulnerable to Arbitrary Command Injection through the subprocess.run and subprocess.Popen functions in shelltool.py. This allows an attacker to inject malicious commands due to insufficient sanitization of user-supplied...
Planet UNI-NMS-Lite Trust Management Issues Vulnerability
Planet UNI-NMS-Lite is a universal network management system from PLANET China that monitors all deployed wired or wireless PoE industrial grade network devices. Planet UNI-NMS-Lite suffers from a trust management issue vulnerability that can be exploited by an attacker to submit a special reques...
