CVE-2025-47857: Improper Neutralization of Special Elements used in an OS Command

A improper neutralization of special elements used in an os command 'os command injection' vulnerability CWE-78 in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or command via crafted CLI commands...

CVE-2025-27759: Improper Neutralization of Special Elements used in an OS Command

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiWeb version 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10 and before 7.0.10 allows an authenticated privileged attacker to execute unauthorized code o...

Fortinet FortiWeb CLI security vulnerabilities

Fortinet FortiWeb CLI is a command line interface from Fortinet, Inc. A security vulnerability exists in Fortinet FortiWeb CLI versions 7.6.0 through 7.6.3 and prior to 7.4.8, which originates from a stack buffer overflow and could lead to the execution of arbitrary code...

CVE-2025-25256: Improper Neutralization of Special Elements used in an OS Command

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1, FortiSIEM 7.2.0 through 7.2.5, FortiSIEM 7.1.0 through 7.1.7, FortiSIEM 7.0.0 through 7.0.3, FortiSIEM 6.7.0 through 6.7.9,...

CVE-2025-32766: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability CWE-121 in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or commands via crafted CLI commands...

Pocsuite

This project is an open-sourced remote vulnerability testing and proof-of-concept development framework called Pocsuite, developed by the Knownsec 404 Team. It comes with a powerful proof-of-concept engine and many niche features for penetration testers and security researchers. The framework...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: cephcsi-fips, step-kms-plugin-fips, skopeo, kubernetes-dashboard-web-fips, aws-nuke, direnv, net-kourier-fips, yunikorn-k8shim, opentelemetry-collector, aws-privateca-issuer-fips, dask-gateway, spicedb, kyverno-fips, aws-load-balancer-controller, packer-fips,...

windmill-cli (>=0.0.1, <=0.0.13) potentially affected by CVE-2025-55152 via @oakserver/oak (>=12.6.2, <=14.1.0)

@oakserver/oak NPM version =12.6.2, =0.0.1, =0.0.13 Source cves: CVE-2025-55152 Source advisory: SNYK:JS-OAKSERVEROAK-11735294...

CVE-2025-54417

Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerability that can bypass CVE-2025-23209: "Craft CMS has a potential RCE with a compromised security key". To exploit this vulnerability, the project must meet these...

CVE-2025-7962 vulnerabilities

Vulnerabilities for packages: thingsboard, wildfly, keycloak-config-cli, apache-nifi, dependency-track, apicurio-registry, jenkins, sonarqube...

GHSA-9342-92GG-6V29 vulnerabilities

Vulnerabilities for packages: dependency-track, geoserver, elasticsearch, keycloak-config-cli, elasticsearch-fips, wildfly, sonarqube, jenkins, commercial-elasticsearch, thingsboard, apache-nifi, apicurio-registry...

CVE-2025-7962 vulnerabilities

Vulnerabilities for packages: dependency-track, geoserver, elasticsearch, keycloak-config-cli, elasticsearch-fips, wildfly, sonarqube, jenkins, commercial-elasticsearch, thingsboard, apache-nifi, apicurio-registry...

aqora-cli (>=0.1.0, <=0.3.2), automatedcleaning (>=0.1.2, <=1.4.0) +64 more potentially affected by CVE-2025-54368 via uv (>=0.1.45, <=0.8.5)

uv PYPI version =0.1.45, =0.1.0, =0.1.2, =1.0.3, =0.5.0.dev0, =1.0.0, =11.5.1, =0.0.24, =1.2.4, =0.2.0, =0.0.1, =0.4.4.dev3, =1.28.0, =1.39.13 and more Source cves: CVE-2025-54368 Source advisory: MEND:CVE-2025-54368...

CVE-2025-48394

An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version which is available on the Eaton download center...

CVE-2025-48394

CVE-2025-48394 affects Eaton CLI (and related Eaton devices noted in connected sources). A privileged, authenticated attacker could modify the contents of a non-sensitive file by traversing the path in the CLI’s limited shell. The issue is mitigated by a fix in the latest Eaton-supplied version a...

Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

...

DDSH CLI Arbitrary Command Execution

The vulnerability of the DDSH CLI interface for Dell EMC Data Domain Operating Systems is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow attackers to execute arbitrary commands...

CVE-2025-54876 Jans CLI stores plaintext passwords in the local cli_cmd.log file

The Janssen Project is an open-source identity and access management IAM platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the local clicmd.log file. This is fixed in the nightly prerelease...

CVE-2025-54876

The Janssen Project IAM stores passwords in plaintext in the local cli_cmd.log file for versions 1.9.0 and below, creating a confidentiality risk. Root cause: passwords written to a local log. Severity is MEDIUM (CVSS 4.0 base 6.9) per the advisory. Remediation: upgrade to a version later than 1....

netlify (22.3.0), netlify-cli (>=22.2.2-pre.dd189fc, <=22.3.0) potentially affected by CVE-2025-54387 via ipx (3.0.3)

ipx NPM version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ipx and may be impacted: - netlify 22.3.0 - netlify-cli =22.2.2-pre.dd189fc, =22.3.0 Source cves: CVE-2025-54387 Source advisory: SNYK:JS-IPX-11483961...