The vulnerability of the ASUS AiCloud cloud platform, related to the lack of measures taken to clean data at the management level, allows a perpetrator to execute arbitrary commands.

The vulnerability of the ASUS AiCloud cloud platform lies in the lack of measures taken at the management level to clean data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the IBM Sterling Secure Proxy proxy server stems from the improper validation of specified input types, allowing attackers to execute arbitrary commands.

The vulnerability of the IBM Sterling Secure Proxy proxy server is related to incorrect validation of the specified data type during input processing. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

Apache Hadoop Code Injection Vulnerability

Apache Ambari is an application from the Apache USA Foundation. Provides software developed to configure, manage and monitor Apache Hadoop clusters to simplify Hadoop management. A code injection vulnerability exists in Apache Hadoop. The vulnerability is due to a vulnerability in the Ambari...

CVE-2024-50692

SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter. It is also possible to impersonate the broker, because TLS is not used to identify the real MQTT broker. This means that MQTT...

CVE-2025-22606

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes...

CVE-2025-22606 Coolify Command Injection Vulnerability in Project Name

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes...

CVE-2025-22606 Coolify Command Injection Vulnerability in Project Name

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes...

CVE-2024-50692

SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter. It is also possible to impersonate the broker, because TLS is not used to identify the real MQTT broker. This means that MQTT...

The vulnerability of the command-line interface (CLI) of FortiWeb web applications allows a hacker to bypass security restrictions and execute arbitrary commands.

The vulnerability of the command-line interface CLI of FortiWeb web applications relates to the execution of operations beyond the buffer limits in memory. Exploiting this vulnerability can allow an attacker to bypass security restrictions and execute arbitrary commands...

I-O Data Device UD-LT2 操作系统命令注入漏洞

I-O Data Device UD-LT2 is a wireless router from I-O Data Device Japan. An operating system command injection vulnerability exists in I-O Data Device UD-LT2 1.00.008SE and prior versions, which stems from the presence of a disjointed special element that allows an attacker to execute arbitrary...

LibreNMS 安全漏洞

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments and automatic updates. A security vulnerability exists in LibreNMS versions prior to 24.10.0 that originates fro...

The vulnerability of the NWS_PF_setMacAddrExceptionIP handler of the NetworkingService service in the Mercedes-Benz User Experience (MBUX) system allows a hacker to execute arbitrary commands.

The vulnerability of the NWSPFsetMacAddrExceptionIP handler of the NetworkingService service in the Mercedes-Benz User Experience MBUX system is related to insufficient validation of input data during MAC address processing. Exploiting this vulnerability can allow an attacker to execute arbitrary...

CVE-2024-51941

A remote code injection vulnerability exists in the Ambari Metrics and AMS Alerts feature, allowing authenticated users to inject and execute arbitrary code. The vulnerability occurs when processing alert definitions, where malicious input can be injected into the alert script execution path. An...

CVE-2024-57036

TOTOLINK A810R V4.1.2cu.5032B20200407 was found to contain a command insertion vulnerability in downloadFile.cgi main function. This vulnerability allows an attacker to execute arbitrary commands by sending HTTP request...

The vulnerability of IBM Concert Software’s artificial intelligence-based automation tool lies in its improper handling of output data from registration logs, allowing a hacker to execute arbitrary commands.

The vulnerability of IBM Concert Software’s artificial intelligence-based automation tool is related to incorrect processing of output data for registration logs. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the graphical interface of the FortiSandbox system allows a perpetrator to execute arbitrary commands.

The vulnerability of the FortiSandbox threat detection and mitigation graphical interface exists due to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using specially created requests...

The vulnerability of the QNAP License Center software lies in its failure to take measures to neutralize special elements used in the operating system’s command set, allowing a violator to execute arbitrary commands.

The vulnerability of the QNAP License Center software management tool is related to the failure to take measures to neutralize special elements used in the operating system command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

WAVLINK AC3000 Command Execution Vulnerability (CNVD-2025-09260)

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. The WAVLINK AC3000 suffers from a command execution vulnerability that originates from the updatefilterurl.sh function failing to properly filter construct command special characters, commands, etc. The vulnerability can be exploited ...

WAVLINK AC3000 External Configuration Control Vulnerability (CNVD-2025-09259)

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. The WAVLINK AC3000 suffers from an external configuration control vulnerability that originates from the openvpn.cgi openvpnserversetup function's selopenprotocol parameter failing to correctly filter constructed command special...

PT-2025-3893 · Netvision Information · Airpass

Name of the Vulnerable Software and Affected Versions: airPASS from NetVision Information affected versions not specified Description: The issue allows remote attackers with regular privileges to inject and execute arbitrary OS commands. This is due to an OS Command Injection vulnerability...