Lucene search
+L

49420 matches found

BDU FSTEC
BDU FSTEC
added 2025/10/24 12:00 a.m.9 views

The vulnerability in the web interface of D-Link DSL-7740C microprogramming device’s router management interface allows a hacker to execute arbitrary commands.

The vulnerability in the web interface for managing D-Link DSL-7740C microprogramming routers is related to insufficient validation of input data during the processing of the EXE parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by sending a specially...

5.3CVSS6.1AI score0.01739EPSS
SaveExploits1References2Affected Software1
OSV
OSV
added 2025/10/23 8:15 p.m.8 views

CVE-2025-54964

An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Service may inject arbitrary executables. If the Job Service is configured for local-only access, this may allow for privilege escalation in certain situations. If the Job Service is...

8.4CVSS5.9AI score0.00311EPSS
SaveExploits0References2
CVE
CVE
added 2025/10/23 7:49 p.m.50 views

CVE-2025-58428

CVE-2025-58428 affects Veeder-Root TLS4B ATG system. The vulnerability stems from the SOAP-based interface being accessible through the web services handler, which enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. Reported impact incl...

9.9CVSS7.2AI score0.0139EPSS
SaveExploits0References4
OSV
OSV
added 2025/10/23 4:15 p.m.12 views

CVE-2025-62713 Kottster app reinitialization can be re-triggered allowing command injection in development mode

Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution RCE vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been...

9.2CVSS8.1AI score
SaveExploits0References4
Snyk
Snyk
added 2025/10/23 4:01 p.m.20 views

Access Control Bypass

Overview @kottster/common is a Common types and utilities for Kottster Affected versions of this package are vulnerable to Access Control Bypass via the initApp and installPackagesForDataSource actions. An attacker can gain unauthorized administrative access and execute arbitrary system commands ...

9.2CVSS7.6AI score0.00609EPSS
SaveExploits0References2
Snyk
Snyk
added 2025/10/23 4:01 p.m.16 views

Access Control Bypass

Overview @kottster/cli is a CLI for Kottster Affected versions of this package are vulnerable to Access Control Bypass via the initApp and installPackagesForDataSource actions. An attacker can gain unauthorized administrative access and execute arbitrary system commands by repeatedly triggering...

9.2CVSS7.5AI score0.00609EPSS
SaveExploits0References2
GithubExploit
GithubExploit
added 2025/10/23 3:30 p.m.193 views

Exploit for OS Command Injection in Tenda Ac15_Firmware

Tenda-Router-VR-and-Exploit...

10CVSS7.6AI score0.7981EPSS
SaveExploits2
OSV
OSV
added 2025/10/23 5:56 a.m.6 views

MAL-2025-48948 Malicious code in haedal-vaults-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4cdc575f935d62b37b17082181381a8002b5784fedda1dfc854ef2f74f39edf6 The OpenSSF Package Analysis project identified 'haedal-vaults-sdk' @ 1.6.0 npm as malicious. It is considered malicious because: - The package...

7.2AI score
SaveExploits0
CNNVD
CNNVD
added 2025/10/23 12:00 a.m.12 views

Veeder-Root TLS4B Automatic Tank Gauge System 命令注入漏洞

Veeder-Root TLS4B Automatic Tank Gauge System is a security management system for gas stations, tank farms, or industrial storage tanks from Veeder-Root, Inc. The Veeder-Root TLS4B Automatic Tank Gauge System suffers from a command injection vulnerability that stems from the SOAP interface being...

9.9CVSS7.6AI score0.0139EPSS
SaveExploits0References4
VulnCheck KEV
VulnCheck KEV
added 2025/10/23 12:00 a.m.12 views

VulnCheck KEV: CVE-2022-1703

Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Commands which potentially leads to remote command execution vulnerability or denial of service DoS attack...

9CVSS6AI score0.12287EPSS
SaveIn wildExploits0References2
Positive Technologies
Positive Technologies
added 2025/10/23 12:00 a.m.15 views

PT-2025-43551

Name of the Vulnerable Software and Affected Versions Veeder-Root TLS4B ATG versions affected versions not specified Description The TLS4B ATG system’s SOAP-based interface is susceptible to command injection due to its accessibility through the web services handler. This allows remote attackers...

9.9CVSS6AI score0.0139EPSS
SaveExploits0References19
Tenable Nessus
Tenable Nessus
added 2025/10/23 12:00 a.m.8 views

Security Updates for Microsoft Word Products C2R (October 2025)

The Microsoft Word Products are missing security updates. It is, therefore, affected by multiple remote code execution vulnerabilities that attackers can exploit to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for these issues but has instead...

7.8CVSS8.9AI score0.00466EPSS
SaveExploits0References3
CVE
CVE
added 2025/10/23 12:00 a.m.33 views

CVE-2025-54964

A vulnerability exists in BAE SOCET GXP versions prior to 4.6.0.2 involving the GXP Job Service . An attacker capable of interacting with this service can inject arbitrary executables . The impact depends on the service configuration: if configured for local-only access, it may lead to privilege ...

7.3AI score0.00311EPSS
SaveExploits0References2Affected Software1
NVD
NVD
added 2025/10/22 4:15 a.m.18 views

CVE-2024-58274

Hikvision CSMP Comprehensive Security Management Platform iSecure Center through 2024-08-01 allows execution of a command within $ in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025...

8.3CVSS0.19085EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2025/10/22 1:12 a.m.17 views

CVE-2025-6542

An arbitrary OS command may be executed on the product by a remote unauthenticated attacker...

9.8CVSS7.3AI score0.01006EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2025/10/22 1:12 a.m.17 views

CVE-2025-6541

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface...

8.8CVSS7.1AI score0.0068EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2025/10/22 12:00 a.m.8 views

VulnCheck KEV: CVE-2024-58274

Hikvision CSMP Comprehensive Security Management Platform iSecure Center through 2024-08-01 allows execution of a command within $ in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025...

8.3CVSS6AI score0.19085EPSS
SaveIn wildExploits0References3
VulnCheck KEV
VulnCheck KEV
added 2025/10/22 12:00 a.m.33 views

VulnCheck KEV: CVE-2016-15048

AMTT Hotel Broadband Operation System HiBOS contains an unauthenticated command injection vulnerability in the /manager/radius/serverping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An...

10CVSS6.1AI score0.07357EPSS
SaveIn wildExploits2References3
CVE
CVE
added 2025/10/22 12:00 a.m.51 views

CVE-2024-58274

CVE-2024-58274 affects Hikvision CSMP iSecure Center (through 2024-08-01). Affected component is the JSON data handling in /center/api/installation/detection, where unverified use of the $() command can lead to arbitrary command execution. Documents indicate exploitation in the wild during 2024 a...

8.3CVSS6.8AI score0.19085EPSS
SaveIn wildExploits0References3
VulnCheck KEV
VulnCheck KEV
added 2025/10/22 12:00 a.m.24 views

VulnCheck KEV: CVE-2025-6264

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...

5.5CVSS7.4AI score0.0103EPSS
SaveIn wildExploits2References9
Rows per page
Query Builder