Linux Distros Unpatched Vulnerability : CVE-2025-2361

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component We...

Linux l2cap_send_cmd() Data Compromise

The vulnerability of the l2capsendcmd function in the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Linux Distros Unpatched Vulnerability : CVE-2019-7342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - POST - Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable...

CVE-2025-9387

A vulnerability was found in DCN DCME-720 9.1.5.11. This affects an unknown function of the file /usr/local/www/function/audit/newstatistics/ipblock.php of the component Web Management Backend. Performing manipulation of the argument ip results in os command injection. It is possible to initiate...

CVE-2025-55602

D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formSysCmd function via the submit-url parameter...

D-Link DIR-619L buffer error vulnerability

D-Link DIR-619L is a home wireless router from AUO D-Link, designed for home and small office environments, utilizing the IEEE 802.11n wireless standard with a maximum transmission rate of 300Mbps. The D-Link DIR-619L suffers from a buffer overflow vulnerability that originates from the submit-ur...

CVE-2010-20059 FreeNAS < 0.7.2 rev 5543 exec_raw.php Arbitrary Command Execution

FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command‐execution backdoor in its web interface. The execraw.php script exposes a cmd parameter that is passed directly to the underlying shell without sanitation...

CVE-2010-20059: Improper Neutralization of Special Elements used in an OS Command

FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command‐execution backdoor in its web interface. The execraw.php script exposes a cmd parameter that is passed directly to the underlying shell without sanitation...

DEBIAN-CVE-2025-38548

In the Linux kernel, the following vulnerability has been resolved: hwmon: corsair-cpro Validate the size of the received input buffer Add bufferrecvsize to store the size of the received bytes. Validate bufferrecvsize in sendusbcmd...

PT-2025-33282 · Kuwfi · Kuwfi Gc111

Name of the Vulnerable Software and Affected Versions: KuWFi GC111 versions GC111-GL-LM321 V3.0 20191211 Description: The KuWFi GC111 device is susceptible to unauthorized command execution. A crafted POST request to the /goform/goform set cmd process API endpoint, utilizing the SSID parameter,...

D-Link Router Command Injection

The vulnerability of D-Link DI-7300G+ and DI-8200G router microprogramming software lies in the lack of measures taken to neutralize special elements when processing parameters such as flag, cmd, and iface on the mspinfo.htm page. Exploiting this vulnerability allows a remote attacker to execute...

org.apache.zeppelin:zeppelin-flink-cmd (>=0.10.0, <=0.11.2), org.apache.zeppelin:zeppelin-spark-submit (>=0.10.0, <=0.11.2) +1 more potentially affected by CVE-2024-51775 via org.apache.zeppelin:zeppelin-shell (>=0.9.0, <=0.11.2)

org.apache.zeppelin:zeppelin-shell MAVEN version =0.9.0, =0.10.0, =0.10.0, =0.9.0, =0.11.2 Source cves: CVE-2024-51775 Source advisory: SNYK:JAVA-ORGAPACHEZEPPELIN-11444035...

org.apache.zeppelin:zeppelin-flink-cmd (>=0.11.1, <=0.11.2), org.apache.zeppelin:zeppelin-spark-submit (>=0.11.1, <=0.11.2) +1 more potentially affected by CVE-2024-51775 via org.apache.zeppelin:zeppelin-shell (>=0.11.1, <=0.11.2)

org.apache.zeppelin:zeppelin-shell MAVEN version =0.11.1, =0.11.1, =0.11.1, =0.11.1, =0.11.2 Source cves: CVE-2024-51775 Source advisory: OSV:GHSA-XG8J-J6VP-6H5W...

org.apache.zeppelin:zeppelin-flink-cmd (>=0.11.1, <=0.11.2), org.apache.zeppelin:zeppelin-spark-submit (>=0.11.1, <=0.11.2) +1 more potentially affected by CVE-2024-51775 via org.apache.zeppelin:zeppelin-shell (>=0.11.1, <=0.11.2)

org.apache.zeppelin:zeppelin-shell MAVEN version =0.11.1, =0.11.1, =0.11.1, =0.11.1, =0.11.2 Source cves: CVE-2024-51775 Source advisory: GHSA-XG8J-J6VP-6H5W...

org.apache.zeppelin:zeppelin-flink-cmd (>=0.11.1, <=0.11.2), org.apache.zeppelin:zeppelin-spark-submit (>=0.11.1, <=0.11.2) +1 more potentially affected by CVE-2024-51775 via org.apache.zeppelin:zeppelin-shell (>=0.11.1, <=0.11.2)

org.apache.zeppelin:zeppelin-shell MAVEN version =0.11.1, =0.11.1, =0.11.1, =0.11.1, =0.11.2 Source cves: CVE-2024-51775 Source advisory: MEND:CVE-2024-51775...

CVE-2025-54131: Improper Neutralization of Special Elements used in a Command

Cursor is a code editor built for programming with AI. In versions below 1.3, an attacker can bypass the allow list in auto-run mode with a backtick or $cmd. If a user has swapped Cursor from its default settings requiring approval for every terminal call to an allowlist, an attacker can execute...

CVE-2013-10051: Improper Neutralization of Directives in Dynamically Evaluated Code

A remote PHP code execution vulnerability exists in InstantCMS version 1.6 and earlier due to unsafe use of eval within the search view handler. Specifically, user-supplied input passed via the look parameter is concatenated into a PHP expression and executed without proper sanitation. A remote...

CVE-2013-10048: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 firmware ≤ 2.13 and ≤ 2.14b01, respectively—due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker c...

CVE-2025-51569: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U1406 router's web interface. The /goform/goformgetcmdprocess endpoint fails to sanitize user input in the cmd parameter before reflecting it into a text/html response. This allows unauthenticated attackers to...

Malicious Package

Overview proc-log-cmd is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...