PT-2025-15320 · Hgiga · Isherlock

Name of the Vulnerable Software and Affected Versions: iSherlock from HGiga affected versions not specified Description: The web service of iSherlock from HGiga has an OS Command Injection issue, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the...

PT-2025-15321 · Isherlock · Isherlock

Name of the Vulnerable Software and Affected Versions: iSherlock affected versions not specified Description: The iSherlock web service has an issue that allows unauthenticated remote attackers to inject and execute arbitrary system commands on the server. This is due to an OS command injection...

CVE-2025-3249 TOTOLINK A6000R mtkwifi.lua apcli_cancel_wps command injection

A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apclicancelwps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The explo...

CVE-2025-29635

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/setprohibiting via the corresponding function, triggering remote command execution...

CVE-2025-2727

A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required...

CVE-2025-2728

A vulnerability has been found in H3C Magic NX30 Pro and Magic NX400 up to V100R014 and classified as critical. This vulnerability affects unknown code of the file /api/wizard/getNetworkConf. The manipulation leads to command injection. The attack needs to be approached within the local network. ...

CVE-2025-2730

The CVE-2025-2730 entry affects H3C Magic NX15, NX30 Pro, NX400, R3010, and BE18000 up to V100R014. The vulnerability exists in an unknown function of the file /api/wizard/getssidname within the HTTP POST Request Handler, causing command injection. Exploitation is described as possible from withi...

CVE-2025-29635

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/setprohibiting via the corresponding function, triggering remote command execution...

CVE-2025-1316 Edimax IC-7100 IP Camera OS Command Injection

Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device...

CVE-2025-1946

A vulnerability was found in hzmanyun Education and Training System 2.1. It has been rated as critical. Affected by this issue is the function exportPDF of the file /user/exportPDF. The manipulation of the argument id leads to command injection. The attack may be launched remotely. The exploit ha...

PT-2025-9719

Name of the Vulnerable Software and Affected Versions: Edimax IC-7100 Description: The Edimax IC-7100 IP camera is vulnerable to a command injection flaw that allows for remote code execution. This vulnerability is actively exploited by Mirai-based botnets, beginning in May 2024, leveraging defau...

CVE-2025-1845

A vulnerability has been found in ESAFENET DSM 3.1.2 and classified as critical. Affected by this vulnerability is the function examExportPDF of the file /admin/plan/examExportPDF. The manipulation of the argument s leads to command injection. The attack can be launched remotely. The exploit has...

CVE-2025-1845

CVE-2025-1845 affects ESAFENET DSM 3.1.2. The vulnerability lies in the function examExportPDF within /admin/plan/examExportPDF, where manipulation of the argument s enables remote command injection. The vulnerability is described as critical with remote attack feasibility and publicly disclosed ...

CVE-2024-53944

CVE-2024-53944 affects Tuoshi/Dionlink LT15D 4G and LT21B devices (M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and M7628xUSAxUIv2_v1.0.1481.15.02_P0). The issue is a command injection via /goform/formJsonAjaxReq where JSON parameters aren’t sanitized, allowing unauthenticated network‑remote attackers to ...

PT-2025-22369

Name of the Vulnerable Software and Affected Versions Smartbedded Meteobridge versions prior to 6.2 Description The Meteobridge web interface is susceptible to a command injection flaw. This allows remote, unauthenticated attackers to execute arbitrary commands with elevated privileges root on...

CVE-2025-27140 WeGIA vulnerable to OS Command Injection at endpoint 'importar_dump.php' parameter 'import' (RCE)

WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the WeGIA application, importardump.php endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely. The command is basically a comma...

CVE-2025-1616

CVE-2025-1616 affects FiberHome AN5506-01A ONU GPON RP2511. The vulnerability lies in the Diagnosis component where manipulating the Destination Address argument enables OS command injection. Exploitation can be remote, and public disclosure of the exploit is noted. Several feeds corroborate the ...

CVE-2025-1610 LB-LINK AC1900 Router set_blacklist websGetVar os command injection

A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/setblacklist. The manipulation of the argument mac/enable leads to os command injection. The attack may be launched remotely. The exploit has...

CVE-2025-1609

CVE-2025-1609 affects LB-LINK AC1900 Router firmware 1.0.2. The vulnerability lies in the websGetVar handling of the cmd parameter in /goform/set_cmd, enabling remote os command injection. Impact: potential remote compromise with high confidentiality, integrity, and availability implications as p...

CVE-2025-1546

A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical. Affected by this vulnerability is the function logoperateclear of the file /webui/modules/log/operate.mds. The manipulation of the argument startcode leads to os command...