CVE-2025-36143

IBM Lakehouse watsonx.data 2.2 could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user supplied input...

CVE-2025-9972

Certain models of Industrial Cellular Gateway developed by Planet Technology have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the device...

PT-2025-42881

Name of the Vulnerable Software and Affected Versions ManageEngine ADManager Plus versions prior to 8024 Description ManageEngine ADManager Plus is affected by an authenticated command injection issue in the Custom Script component. The issue allows for the execution of arbitrary commands...

Linksys WRT160Nv2 apply.cgi Command Execution

The vulnerability in the apply.cgi script of the Linksys WRT160Nv2 router microprogramming system is related to the improper elimination of certain elements used in the operating system’s command for processing the pingsize parameter. Exploiting this vulnerability allows an attacker to execute...

CVE-2025-37127

A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell access. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, potentially...

Security Bulletin: IBM Lakehouse Command Injection via Insufficient Input Sanitization , affects watsonx.data

Summary IBM Lakehouse could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user supplied input.This can affect watsonx.data. Vulnerability Details CVEID:CVE-2025-36143 DESCRIPTION: IBM Lakehouse could allow an authenticated...

Security Updates for Microsoft Office Online Server (September 2025)

The Microsoft Office Online Server installation on the remote host is missing security updates. It is, therefore, affected by multiple remote code execution vulnerabilities. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. %NASLMINLEVEL 80900 C...

CVE-2025-57293

A command injection vulnerability exists in the COMFAST CF-XR11 wireless router (firmware V2.7.2 ) within the multi_pppoe API. The root cause is a failure to sanitize the phy_interface parameter in the sub_423930 function of /usr/bin/webmgnt. An attacker can submit a POST request to /cgi-bin/mbox...

CVE-2025-37126

A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as...

CVE-2025-37123 Authenticated Command Injection leads to Unauthorized Actions in CLI Interface

A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on...

CVE-2025-37129

CVE-2025-37129 describes a vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways . An authenticated attacker could exploit the built-in script execution capability to execute arbitrary commands on the underlying operating system if the feature is enabled ...

CVE-2025-37129 Authenticated Remote Code Execution allows Exploit in Scripts Feature

A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system if the feature is...

CVE-2025-37127 Authenticated Replay Attack contains Cryptographic Vulnerability

A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell access. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, potentially...

CVE-2025-37127

CVE-2025-37127 affects HPE Aruba Networking EdgeConnect SD-WAN Gateways. The vulnerability arises from flaws in the cryptographic logic, allowing an authenticated remote attacker to gain shell access and potentially execute arbitrary OS commands, leading to unauthorized control of the affected sy...

PT-2025-38093

Name of the Vulnerable Software and Affected Versions: HPE Aruba Networking EdgeConnect SD-WAN Gateways affected versions not specified Description: A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to...

PT-2025-38089

Name of the Vulnerable Software and Affected Versions: EdgeConnect SD-WAN affected versions not specified Description: A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful...

HikCentral Master Lite CSV Command Injection

The vulnerability of the HikCentral Master Lite video surveillance and security management software lies in the absence of a mechanism for neutralizing CSV files. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...

CVE-2025-56406

An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supplier's position is that authentication is not mandatory for MCP servers, and the mcp-neo4j MCP server is only intended for use in a local...

Cisco ASA FTD Privilege Escalation

The vulnerability of Microprogramming Software in Cisco Adaptive Security Appliances ASA and Cisco Firepower Threat Defense FTD is related to deficiencies in the mechanism for assigning internal resource access levels for debugging purposes. Exploiting this vulnerability can allow attackers to...

CVE-2025-41701

An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool. These arbitrary commands are executed in the user context...