Improper Access Control

flowise is vulnerable to improper access control.The vulnerability is due to insufficient file path restrictions in the WriteFileTool and ReadFileTool, which allows an attacker to read or write arbitrary files and potentially achieve remote command execution...

The vulnerability of the microprogrammed software of the EDIMAX BR-6478AC router, related to the lack of measures for cleaning input data, allows a hacker to execute arbitrary commands.

The vulnerability of the microprogrammed software of the EDIMAX BR-6478AC router lies in the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

📄 FreePBX 17.0.3 SQL Injection

FreePBX version 17.0.3 proof of concept unauthenticated remote SQL injection exploit that leverages ajax.php. ============================================================================================================================================= | Title : FreePBX 17.0.3 Unauthenticated SQL...

TRENDnet TEW-657BRM Command Injection Vulnerability

The TRENDnet TEW-657BRM is a WiFi router from TRENDnet. The TRENDnet TEW-657BRM suffers from a command injection vulnerability that is caused by a flaw in the setup.cgi binary file. An attacker can exploit this vulnerability to execute arbitrary operating system commands on the system...

MAL-2025-191480 Malicious code in accounts-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07acaccf5cae78ad4bfd5f967e15c5ba68180c1350310492a9065ca97124bf26 The package accounts-base was found to contain malicious code. Source: ghsa-malware cf76e57ba69c401756a0d9279f66fcd197667ce73a011c643099737d08dc306c...

CVE-2025-64127

An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to execute arbitrary commands remotely...

CVE-2025-64128

An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, which could permit attackers to append arbitrary data. This could allow an unauthenticated attacker to inject arbitrary commands...

Malicious code in wartsila-application-json (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e0377e0cb41b793d9733d21ccf71ee44de194a8988cbbd874d88c3cb5e03cce The package wartsila-application-json was found to contain malicious code. Source: ghsa-malware...

The vulnerability of the httpd-demon (/goform/SetIpMacBind) of the Tenda AC21 router software allows a attacker to execute arbitrary commands or cause service interruptions.

The vulnerability of the httpd-demon /goform/SetIpMacBind of the Tenda AC21 router’s microprogramming software is related to the operation that goes beyond the buffer in memory when processing the list parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the microprogrammed software of the Zenitel TCIV-3+ IP video door phones lies in the lack of measures to neutralize the special elements used in the operating system’s commands, allowing intruders to execute arbitrary commands.

The vulnerability of the microprogrammed software of the Zenitel TCIV-3+ IP video door phones is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

📄 Cisco ISE API 3.0 Command Injection

Proof of concept exploit for a command injection vulnerability in Cisco ISE API version 3.0. ============================================================================================================================================= | Title : Cisco ISE API 3.0 command injection Exploits | |...

The vulnerability of the microprogrammed software of the Zenitel TCIV-3+ IP video door phones lies in the lack of measures to neutralize the special elements used in the operating system’s commands, allowing intruders to execute arbitrary commands.

The vulnerability of the microprogrammed software of the Zenitel TCIV-3+ IP video door phones is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the httpd-demon (/goform/SetSysTimeCfg) in the microprogramming software for Tenda AC21 allows a perpetrator to execute arbitrary commands or cause service interruptions.

The vulnerability of the httpd-demon /goform/SetSysTimeCfg in the Tenda AC21 router microprogramming system is related to the operation of writing data beyond the buffer in memory when processing parameters for time and timeZone. Exploiting this vulnerability allows a remote attacker to execute...

The vulnerability in the gena.cgi script of D-Link DIR-852 router software allows a hacker to escalate their privileges and execute arbitrary commands.

The vulnerability in the gena.cgi script of D-Link DIR-852 router software is related to incorrect elimination of certain special elements. Exploiting this vulnerability allows an attacker to enhance their privileges and execute arbitrary commands...

Arbitrary Command Injection

Overview willitmerge is an A command line tool to check if pull requests are mergeable. Affected versions of this package are vulnerable to Arbitrary Command Injection due to the use of insecure child process execution API exec. An attacker can execute arbitrary system commands by supplying craft...

CVE-2025-64128

CVE-2025-64128 refers to an OS command injection in Zenitel TCIV-3+ caused by incomplete input validation. Public sources in the connected documents identify the affected product as Zenitel TCIV-3+ and indicate that versions prior to 9.3.3.0 are vulnerable (CNNVD). The vulnerability allows an una...

CVE-2025-64127 Zenitel TCIV-3+ OS Command Injection

An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to execute arbitrary commands remotely...

CVE-2025-12472

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for...

Remote Command Execution

scio-pypi is vulnerable to Remote Command Execution. The vulnerability is due to torch.load executing unsafe deserialization even when weightsonly=True, which allows an attacker to craft malicious model files that trigger arbitrary code execution during loading...

MAL-2025-191477 Malicious code in bitcoin-main-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f6833ddd073b7c036ec32739e3cb826bd1eda9d3c350eed423548f64f047b2 The package bitcoin-main-lib was found to contain malicious code. Source: ghsa-malware 06ed1aa4aa61f36d953368c74cb3daf102b02842a6a27843021b499b033d71...