CVE-2025-44854

CVE-2025-44854 affects TOTOLINK CP900 (V6.3c.1144_B20190715). The vulnerability exists in the setUpgradeUboot function via the FileName parameter, enabling command injection and potential arbitrary command execution. Multiple connected sources corroborate the issue and link it to a vulnerable CP9...

CVE-2025-44866

CVE-2025-44866 affects the Tenda W20E router. A command injection exists in the formSetDebugCfg function via the level parameter, enabling arbitrary command execution through a crafted request. Affected software: Tenda W20E firmware version 15.11.0.6. Root cause: improper handling/filtering of sp...

CVE-2025-44860

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44837

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url or magicid parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44847

CVE-2025-44847 affects TOTOLINK CA600-PoE, specifically version 5.3c.6665_B20180820. The root cause is a command injection vulnerability in the setWebWlanIdx function triggered by the webWlanIdx parameter, allowing an attacker to execute arbitrary commands via a crafted request. CVSS metrics (rep...

CVE-2025-44837

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url or magicid parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44841

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44844

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44861

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44846

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44843

CVE-2025-44843 affects TOTOLINK CA600-PoE (V5.3c.6665_B20180820). A command-injection vulnerability exists in CloudSrvUserdataVersionCheck via the url parameter, enabling arbitrary command execution. Reported across multiple sources (NVD, Red Hat, CNVD, CVE.org, etc.), with CVSSv3.1: Network atta...

CVE-2025-44839

CVE-2025-44839 affects TOTOLINK CA600-PoE (V5.3c.6665_B20180820). The CloudSrvUserdataVersionCheck function is vulnerable to command injection via the magicid parameter, allowing arbitrary commands through a crafted request. Root cause: insufficient filtering of constructed command characters in ...

CVE-2025-44842

CVE-2025-44842 affects TOTOLINK CA600-PoE (V5.3c.6665_B20180820). A vulnerability in the msg_process function, via the Port parameter, allows command injection by crafting a request. The root cause is insufficient filtering/validation of command-related characters in that parameter, enabling arbi...

CVE-2025-44839

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the magicid parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

PyTorch Remote Command Execution Vulnerability

PyTorch is a Python package open-sourced by PyTorch. PyTorch suffers from a remote command execution vulnerability that can be exploited by an attacker to execute arbitrary commands on a system...

Bosch Rexroth ctrlX OS 安全漏洞

Bosch Rexroth ctrlX OS is a Linux-based real-time operating system from Bosch Rexroth, an open control platform designed for industrial automation equipment. A security vulnerability exists in Bosch Rexroth ctrlX OS, which originates from a specially crafted HTTP request in the remote logging...

SQL Injection

@posthog/plugin-server is vulnerable to SQL Injection. The vulnerability is due to the lack of proper validation of a user-supplied string before using it to construct SQL queries, allows attackers to inject malicious SQL code and execute arbitrary commands in the context of the database account...

CVE-2025-45956

CVE-2025-45956 affects Sourcecodester Computer Laboratory Management System v1.0, via SQL injection in the file manage_damage.php. An authenticated attacker can leverage the vulnerable id parameter to execute arbitrary SQL commands, potentially compromising data integrity and confidentiality as r...

Ubuntu: Security Advisory (USN-7466-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-7466-1: KiCad vulnerabilities

It was discovered that KiCad incorrectly handled memory when opening malicious files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary commands...