The vulnerability of the dataexport.php web tool of the PostgreSQL administration PHP script phpPgAdmin allows a perpetrator to execute arbitrary commands.

The vulnerability of the dataexport.php web tool of the phpPgAdmin administration tool for PostgreSQL lies in the lack of security measures for SQL query structures. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...

The vulnerability of the sub_402414() function in TOTOLINK A720R router microprogramming software allows a intruder to execute arbitrary commands.

The vulnerability of the sub402414 function in TOTOLINK A720R router microprogramming systems is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow an attacker, operating remotely, to execute arbitrary commands...

The vulnerability of the sub_432F60 function in D-Link DIR-882 wireless router software allows a hacker to execute arbitrary commands.

The vulnerability of the sub432F60 function in D-Link DIR-882 wireless routers is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the sub_40BFA4() function in TOTOLINK A720R router microprogramming software allows a intruder to execute arbitrary commands.

The vulnerability of the sub40BFA4 function in TOTOLINK A720R router microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

The vulnerability of the sub_433188 function in D-Link DIR-882 wireless router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the sub433188 function in D-Link DIR-882 wireless routers is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the sub_4438A4() function in D-Link DIR-882 wireless router software allows a hacker to execute arbitrary commands.

The vulnerability of sub4438A4 in D-Link DIR-882 wireless router microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability in the web interface of the D-Link DIR-1260 router’s microprogramming software allows a hacker to execute arbitrary commands with root privileges.

The vulnerability in the web interface of the D-Link DIR-1260 router operating system exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands when processing the SetDest/Dest/Target parameter. Exploiting this vulnerability allows a remote...

The vulnerability of the SetDynamicDNSSettings function in D-link DIR-878A1 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the SetDynamicDNSSettings function in D-link DIR-878A1 router microprogramming software is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the sub_4621DC function in the usb_paswd.asp file of the jhttpd component of D-Link routers such as DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003, and DI-8003G allows a hacker to execute arbitrary commands.

The vulnerability of the sub4621DC function in the usbpaswd.asp file of the jhttpd component of D-Link routers such as DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003, and DI-8003G is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows an...

PT-2025-48554

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27 Description Grav is a file-based Web platform with a Server-Side Template Injection SSTI issue. Authenticated attackers with editor permissions can execute arbitrary commands on the server. Under certain...

Kerlink KerOS 安全漏洞

Kerlink KerOS is an operating system from the French company Kerlink. A security vulnerability exists in Kerlink KerOS versions prior to 5.12 that stems from the wmp-agent service not properly validating magic URLs, which could allow an unauthenticated remote attacker to execute arbitrary OS...

CVE-2024-39148

The KerOS operating system (versions prior to 5.12 ) contains a vulnerability in the wmp-agent service due to improper validation of so-called 'magic URLs' . An unauthenticated remote attacker can exploit this to execute arbitrary OS commands as root if the service is reachable over the network. ...

CVE-2024-39148: Improper Control of Generation of Code

The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is reachable over network. Typically, the service is protected via local firewall...

The vulnerability of the /var/system/linux_vlan_reinit file in the microprogramming software for D-link DIR-823G routers allows a hacker to execute arbitrary commands.

The vulnerability of the /var/system/linuxvlanreinit file in the microprogramming-based routing software of D-link DIR-823G routers is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-35028 HexStrike AI MCP Server Command Injection

By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There...

Malicious code in wds-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 827b1d3e49cfad3ca5aa4eeb1a7afedc234ed734e13948ba28b0e3b3b71180cc The package wds-icons was found to contain malicious code. Source: ghsa-malware 24d19b105cd9931a78806b2c2f9a30d8ef982b16e1ed4620c185a75dbbbf610d Any...

Malicious code in com.unity.sharp-zip-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cedde339d72e05699d5f33d7c16779f926f419baded72d7cd78d2610395cc807 The package com.unity.sharp-zip-lib was found to contain malicious code. Source: ghsa-malware...

Malicious code in eslint-plugin-react-hooks-published (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 647dedd2c8ea8a9cef54b85666b74459095d17369da310d54a0c1960f87dafe6 The package eslint-plugin-react-hooks-published was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191486 Malicious code in vitest-environment-jsdom-patched (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e0d8ae07807d73026bd13988c3341aecf8375b53ae436d03f80110884c5d84e The package vitest-environment-jsdom-patched was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199907

OrangeHRM is a comprehensive human resource management HRM system. From version 5.0 to 5.7, the application contains an input-neutralization flaw in its mail configuration and delivery workflow that allows user-controlled values to flow directly into the system’s sendmail command. Because these...