CVE-2025-56413

OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitrary commands via the operation parameter to the /api/v2/hosts/ssh/operate endpoint...

Command Injection

screenshot-desktop is vulnerable to command injection. The vulnerability is due to unsanitized user-controlled input being passed into the format option of the screenshot function, which allows an attacker to execute arbitrary commands with the privileges of the calling process...

CVE-2025-56406

An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supplier's position is that authentication is not mandatory for MCP servers, and the mcp-neo4j MCP server is only intended for use in a local...

Neo4j MCP Clients & Servers 安全漏洞

Neo4j MCP Clients & Servers is a Neo4j Contrib open source protocol for managing large language model contexts. A security vulnerability exists in Neo4j MCP Clients & Servers version 0.3.0, which originates in the SSE service and could lead to the disclosure of sensitive information or the...

PT-2025-37048

Name of the Vulnerable Software and Affected Versions: mcp-neo4j version 0.3.0 Description: An issue was discovered that allows attackers to gain sensitive information or execute arbitrary commands via the SSE service. Recommendations: At the moment, there is no information about a newer version...

Microsoft Windows Multiple Vulnerabilities (KB5065430)

This host is missing a critical security update according to Microsoft KB5065430 SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-41701

An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool. These arbitrary commands are executed in the user context...

CVE-2025-42944 Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)

Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high...

Beckhoff TwinCAT 代码问题漏洞

Beckhoff TwinCAT is a software system from Beckhoff Germany consisting of a real-time environment and a real-time system for executing control programs in a development environment. The system is mainly used for PLC Programmable Logic Controller programming, diagnostics and system configuration. ...

PT-2025-36961

Name of the Vulnerable Software and Affected Versions: Calix GigaCenter ONT versions 844E Calix GigaCenter ONT versions 844G Calix GigaCenter ONT versions 844GE Calix GigaCenter ONT versions 854GE Description: An OS Command Injection issue exists in Calix GigaCenter ONT Quantenna SoC modules...

PT-2025-36688

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected...

CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

CVE-2025-58370

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent was configured to auto-approve execution of...

CVE-2025-58370 Roo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect Reference

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent was configured to auto-approve execution of...

PT-2025-36338

Name of the Vulnerable Software and Affected Versions: Roo Code versions prior to 3.26.0 Description: Roo Code is an AI-powered autonomous coding agent. A weakness exists in the command parsing logic due to incorrect handling of Bash parameter expansion and indirect reference. If the agent was...

OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command executes outside the context of the user account that entered the command line.

...

Baidu.com Windows Client Remote Command Execution Vulnerability

BaiduNetdisk BaiduNetdisk is a cloud-based platform that provides file storage, synchronization and sharing services. Users can store their personal files through BaiduNetdisk and can share files by linking or inviting others. BaiduNetdisk also provides a file synchronization feature that allows...

Linux Distros Unpatched Vulnerability : CVE-2017-12636

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CouchDB administrative users can configure the database server via HTTPS. Some of the configuration options include paths for operating system-level binaries th...

CVE-2025-50755

Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsyscmd function via the command parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-50757

Wavlink WN535K3 (version 20191010) is affected by a command-injection vulnerability in the set_sys_adm function triggered via the username parameter. The flaw enables attackers to execute arbitrary commands through a crafted request. CVSSv3.1 base score is 6.5 (Network, Low attack complexity, No ...