Mitsubishi Electric smartRTU 操作系统命令注入漏洞

The Mitsubishi Electric smartRTU is an intelligent remote terminal unit RTU from Mitsubishi Electric Japan. The Mitsubishi Electric smartRTU suffers from an operating system command injection vulnerability that stems from an authentication bypass that could result in the execution of arbitrary OS...

Hidden Functionality

Overview Affected versions of this package are vulnerable to Hidden Functionality via a hidden FTP command trigger in the process. An attacker can execute arbitrary shell commands with root privileges by sending a specially crafted FTP command. Remediation Upgrade proftpd/proftpd to version 1.3.3...

CVE-2010-20103 ProFTPD 1.3.3c Backdoor Command Execution

A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows...

TOTOLINK EX1200T Router Arbitrary Command Execution

The vulnerability of the built-in web server boa /boafrm/formReflashClientTbl of TOTOLINK EX1200T router microprogramming software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands or cause ...

TOTOLINK A3002R 安全漏洞

The TOTOLINK A3002R is a wireless router manufactured by China's Gion Electronics TOTOLINK, whose main function is to provide wireless network connectivity for home or small office environments. The TOTOLINK A3002R suffers from an OS command injection vulnerability, which stems from a command...

FortiOS Memory Reclamation Command Execution

The vulnerability of the FortiOS operating systems and the FortiProxy proxy server for protection against Internet attacks is related to a memory reclamation error. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Joomla! SQL注入漏洞

Joomla! is a free, open source content management system from Joomla! open source. A SQL injection vulnerability exists in Joomla! versions 3.9.2-3.10.1, which originates from a privileged user being able to execute arbitrary SQL commands, potentially resulting in a SQL injection attack...

Security Updates for Microsoft Excel Products C2R (August 2025)

The Microsoft Excel Products are missing a security update. It is, therefore, affected by multiple remote code execution vulnerabilities that attackers can exploit to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for these issues but has instea...

Security Updates for Microsoft Word Products C2R (August 2025)

The Microsoft Word Products are missing security updates. It is, therefore, affected by multiple remote code execution vulnerabilities that attackers can exploit to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for these issues but has instead...

CVE-2025-55672 Apache Superset: Stored XSS on charts metadata

A stored Cross-Site Scripting XSS vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they...

CVE-2025-55672

A stored Cross-Site Scripting XSS vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they...

HomeAssistant-Tapo: Cameras Control 代码注入漏洞

HomeAssistant-Tapo: Cameras Control is a Tapo camera controller by the individual developer Juraj Nyíri. A code injection vulnerability exists in HomeAssistant-Tapo: Cameras Control, which stems from a code injection vulnerability in the GitHub Actions workflow that could lead to the execution of...

Flowise Custom MCP Remote Code Execution

This module exploits a remote code execution vulnerability in Flowise versions = 2.2.7-patch.1 and use exploit/multi/http/flowise/custommcprce msf undefinedcustommcprce show actions ...actions... msf undefinedcustommcprce set ACTION msf undefinedcustommcprce show options ...show and set options...

PT-2025-33339 · Cisco · Cisco Secure Firewall Management Center (Fmc)

Name of the Vulnerable Software and Affected Versions: Cisco Secure Firewall Management Center FMC Software affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software could allow an authenticated, remo...

Cisco Secure Firewall Adaptive Security Appliance和Cisco Secure Firewall Threat Defense 安全漏洞

Cisco Secure Firewall Adaptive Security Appliance and Cisco Secure Firewall Threat Defense are both products of Cisco, Inc.Cisco Secure Firewall Adaptive Cisco Secure Firewall Adaptive Security Appliance is an enterprise-class firewall software.Cisco Secure Firewall Threat Defense is an integrate...

Versa Director Webhook Arbitrary Command Privilege Escalation

The vulnerability of the “Add Webhook” and “Test Webhook” functions of the Webhook Feature component in the software platform for managing network infrastructure, Versa Director, is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious acto...

CVE-2025-47857

A improper neutralization of special elements used in an os command 'os command injection' vulnerability CWE-78 in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or command via crafted CLI commands...

CVE-2025-27759

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiWeb version 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10 and before 7.0.10 allows an authenticated privileged attacker to execute unauthorized code o...

Security Updates for Microsoft PowerPoint Products (August 2025)

The Microsoft PowerPoint Products are missing a security update. They are, therefore, affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for this issue but has instea...

PT-2025-32690 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.8 Description: WeGIA is an open-source web manager designed for the Portuguese language and charitable institutions. A SQL Injection vulnerability exists in the /html/funcionario/dependente remover.php API endpoint...