50340 matches found
CVE-2019-25257 LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation
LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying configuration parameters like antivirus.command,...
CVE-2019-25243 FaceSentry 6.4.8 Authenticated Remote Command Injection via Ping Test
FaceSentry 6.4.8 contains an authenticated remote command injection vulnerability in pingTest.php and tcpPortTest.php scripts. Attackers can exploit unsanitized input parameters to inject and execute arbitrary shell commands with root privileges by manipulating the 'strInIP' and 'strInPort'...
CVE-2018-25135 Anviz AIM CrossChex Standard 4.3.6.0 CSV Injection via User Import
Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing...
CVE-2018-25135 Anviz AIM CrossChex Standard 4.3.6.0 CSV Injection via User Import
Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing...
riello-multiple-vulnerabilities-2025
Riello UPS with NetMan 208 - Vulnerability Disclosure During...
CVE-2025-25364
A command injection vulnerability in the me.connectify.SMJobBlessHelper XPC service of Speedify VPN up to v15.0.0 allows attackers to execute arbitrary commands with root-level privileges...
The vulnerability in the web interface for managing IP-telephony systems FreePBX allows a perpetrator to execute arbitrary code.
The vulnerability of the FreePBX IP-telephony system’s web management interface is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
The vulnerability of the web interface of Avtech’s microprogrammed software-based IP cameras allows a intruder to execute arbitrary commands.
The vulnerability of the web interface of Avtech’s microprogrammed software-based cameras is related to the lack of measures taken at the control level to protect data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
The vulnerability of the web interface of Avtech’s microprogrammed software-based IP cameras allows a intruder to execute arbitrary commands.
The vulnerability of the web interface of Avtech’s microprogramming software-based IP cameras is related to the lack of measures taken at the control level to protect data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
Microhard Systems IPn4G 安全漏洞
Microhard Systems IPn4G is a cellular wireless gateway from Microhard Canada. A security vulnerability exists in Microhard Systems IPn4G version 1.1.0 that originates from a restricted shell that can be escaped via a customized ping command, which could result in the execution of commands with ro...
CVE-2019-25257: Untrusted Search Path
LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying configuration parameters like antivirus.command,...
PT-2025-53343
Name of the Vulnerable Software and Affected Versions LogicalDOC Enterprise version 7.7.4 Description The software contains multiple authenticated operating system command execution flaws. These flaws permit attackers to manipulate binary paths when altering system settings. Exploitation involves...
Advantech WebAccess/SCADA SQL Injection Vulnerability
Advantech WebAccess/SCADA is a set of SCADA software based on browser architecture from Advantech, China. The software supports dynamic graphical display and real-time data control, and provides remote control and management of automation equipment. An SQL injection vulnerability exists in...
The vulnerability of the web interface of Avtech’s microprogrammed software-based IP cameras allows a intruder to execute arbitrary commands.
The vulnerability of the web interface of Avtech’s microprogrammed software-based cameras is related to the lack of measures taken at the control level to protect data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
TencentOS Server 4: edk2 (TSSA-2025:0967)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0967 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...
The vulnerability of the REST API interface of the Cisco Catalyst Center (formerly Cisco DNA Center) allows a attacker to execute arbitrary commands.
The vulnerability of the REST API interface of the Cisco Catalyst Center formerly Cisco DNA Center exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...
The vulnerability of the web interface of Avtech’s microprogrammed software-based IP cameras allows a intruder to execute arbitrary commands.
The vulnerability of the web interface of Avtech’s microprogramming software-based IP cameras is related to the lack of measures taken at the control level to protect data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
CVE-2025-66210
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Import functionality allows users with application/service management permissions to execute...