CVE-2025-34099

An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidialsalesviewer.php component when password encryption is enabled a non-default configuration. The application improperly passes the HTTP Basic Authentication password directly ...

CVE-2025-7415 Tenda O3V2 httpd getTraceroute fromTraceroutGet command injection

A vulnerability, which was classified as critical, has been found in Tenda O3V2 1.0.0.123880. This issue affects the function fromTraceroutGet of the file /goform/getTraceroute of the component httpd. The manipulation of the argument dest leads to command injection. The attack may be initiated...

CVE-2025-7407

Netgear D6400 1.0.0.114 contains a remote OS command injection in the diag.cgi file, exploitable via manipulation of the host_name argument. This affects the Netgear D6400 router and is confirmed across multiple sources; exploitation is publicly disclosed and is possible remotely. The vendor note...

CVE-2025-3626

A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command 'OS Command Injection' while uploading a config file via webUI...

CVE-2025-7097

A vulnerability, which was classified as critical, has been found in Comodo Internet Security Premium 12.3.4.8162. This issue affects some unknown processing of the file cisupdatex64.xml of the component Manifest File Handler. The manipulation of the argument binary/params leads to os command...

CVE-2025-37102

An authenticated command injection vulnerability exists in the Command line interface of HPE Networking Instant On Access Points. A successful exploitation could allow a remote attacker with elevated privileges to execute arbitrary commands on the underlying operating system as a highly privilege...

CVE-2025-7097

CVE-2025-7097 affects Comodo Internet Security Premium 12.3.4.8162. The vulnerability is in the Manifest File Handler’s cis_update_x64.xml processing, where manipulating the binary/params argument enables os command injection. Exploitation is network‑based and may be remote; attack complexity is ...

CVE-2025-7082

The CVE-2025-7082 entry concerns Belkin F9K1122 (firmware 1.00.33) and the webs component, specifically the function formBSSetSitesurvey in /goform/formBSSetSitesurvey. The vulnerability arises from improper handling/manipulation of the arguments wan_ipaddr, wan_netmask, wan_gateway, and wl_ssid,...

CVE-2025-7081 Belkin F9K1122 webs formSetWanStatic os command injection

A vulnerability has been found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this vulnerability is the function formSetWanStatic of the file /goform/formSetWanStatic of the component webs. The manipulation of the argument...

CVE-2025-7081

CVE-2025-7081 affects Belkin F9K1122 firmware 1.00.33, specifically the function setWanStatic in /goform/formSetWanStatic of the webs component. The vulnerability arises from allowing an attacker to directly control the arguments m_wan_ipaddr, m_wan_netmask, m_wan_gateway, m_wan_staticdns1, and m...

PT-2025-27631

Name of the Vulnerable Software and Affected Versions: Maltrail versions =0.54 Description: An unauthenticated command injection issue exists, allowing a remote attacker to execute arbitrary operating system commands via the username parameter in a POST request to the "/login" endpoint. This occu...

CVE-2025-6899 D-Link DI-7300G+/DI-8200G msp_info.htm os command injection

A vulnerability, which was classified as critical, was found in D-Link DI-7300G+ and DI-8200G 17.12.20A1/19.12.25A1. This affects an unknown part of the file mspinfo.htm. The manipulation of the argument flag/cmd/iface leads to os command injection. It is possible to initiate the attack remotely...

CVE-2025-6896

CVE-2025-6896 affects D-Link DI-7300G+ (0) with firmware version 19.12.25A1. The vulnerability is in an unknown function of wget_test.asp, where improper handling of the url parameter enables os command injection. Impact is remote, with exploitation disclosed publicly. Several sources (NVD/Red Ha...

CVE-2025-34042

CVE-2025-34042 describes an authenticated command-injection vulnerability in Beward N100 IP Camera firmware version M2.1.6.04C014. The issue stems from unsafely embedded ServerName and TimeZone parameters in the servetest CGI page, allowing an authenticated attacker with web-interface access to i...

CVE-2025-6335

A vulnerability was found in DedeCMS up to 5.7.2 and classified as critical. This issue affects some unknown processing of the file /include/dedetag.class.php of the component Template Handler. The manipulation of the argument notes leads to command injection. The attack may be initiated remotely...

PT-2025-26234 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS versions up to 5.7.2 Description: A critical vulnerability was found in DedeCMS affecting the Template Handler component. The issue resides in some unknown processing of the file /include/dedetag.class.php. Manipulation of the argumen...

CVE-2025-6103 Wifi-soft UniBox Controller test_accesscodelogin.php os command injection

A vulnerability, which was classified as critical, has been found in Wifi-soft UniBox Controller up to 20250506. Affected by this issue is some unknown functionality of the file /billing/testaccesscodelogin.php. The manipulation of the argument Password leads to os command injection. The attack m...

CVE-2025-41663

The CVE-2025-41663 entry pertains to the Weidmueller IE-SR-2TX-WL industrial security router. Affected component is the u-link Management API, where an unauthenticated, man‑in‑the‑middle attacker can inject arbitrary commands in responses returned by WWH servers, leading to arbitrary command exec...

EulerOS 2.0 SP13 : emacs (EulerOS-SA-2025-1629)

According to the versions of the emacs package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands o...

CVE-2025-4653 Remote Code Execution leads to Command Injection

Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105...