CVE-2025-44865

The Tenda W20E router, specifically version 15.11.0.6 , is vulnerable to a command injection flaw within the formSetDebugCfg function. The vulnerability occurs because the enable parameter fails to properly filter shell metacharacters and commands, allowing an attacker to execute arbitrary comman...

CVE-2025-44840

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44843

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44848

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44836

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44846

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44867

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44862

The TOTOLINK CA300-POE wireless access point (version V6.2c.884_B20180522 ) is vulnerable to a command injection vulnerability within the recvUpgradeNewFw function. The root cause is a failure to properly filter and clean data at the management level when processing the fwUrl parameter, specifica...

CVE-2025-4121

A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function cmdwireless. The manipulation of the argument host leads to command injection. The attack can be launched remotely. The vendor was contacted early about this...

PT-2025-18200 · Lb Link · Lb-Link Bl-Ac3600

Name of the Vulnerable Software and Affected Versions: LB-LINK BL-AC3600 versions up to 1.0.22 Description: A critical issue has been discovered, affecting the Password Handler component. Specifically, it impacts the easy uci set option string 0 function within the /cgi-bin/lighttpd.cgi file. The...

GHSA-JMJF-MFHM-J3GF AWorld OS Command Injection vulnerability

A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function subprocess.run/subprocess.Popen of the file AWorld/aworld/virtualenvironments/terminals/shelltool.py. The manipulation leads to os command...

CVE-2025-4032 inclusionAI AWorld shell_tool.py subprocess.Popen os command injection

A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function subprocess.run/subprocess.Popen of the file AWorld/aworld/virtualenvironments/terminals/shelltool.py. The manipulation leads to os command...

Planet UNI-NMS-Lite System Command Injection Vulnerability

Planet UNI-NMS-Lite is a universal network management system from PLANET China that monitors all deployed wired or wireless PoE industrial grade network devices. Planet UNI-NMS-Lite suffers from a command injection vulnerability that can be exploited by an attacker to submit a special request to...

CVE-2025-46271

UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data...

GNU Mailman Command Injection Vulnerability

GNU Mailman is a mailing list management software commonly used to create, manage and maintain mailing lists. A command injection vulnerability exists in GNU Mailman. The vulnerability stems from a failure to properly filter shell metacharacters in the subject line of an email message. An attacke...

PT-2025-17699 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns a command injection vulnerability in the Apache HTTP Server. No specific details about the number of potentially affected devices or real-world incidents are...

CVE-2025-2773

CVE-2025-2773 refers to a command injection/remote code execution flaw in BEC Technologies' Multiple Routers. The vulnerability resides in the management interface (listening on TCP port 22 by default), where insufficient validation of a user-supplied string before a system call allows an attacke...

PT-2025-17849 · Yt-Dlp +1 · Yt-Dlp +1

Name of the Vulnerable Software and Affected Versions: YoutubeDLSharp versions 1.0.0-beta4 through 1.1.2 Description: The issue is related to an unsafe conversion of arguments, allowing the injection of malicious commands when starting yt-dlp from a command prompt on Windows OS with the...

JetBrains Toolbox App Command Injection Vulnerability

JetBrains Toolbox App is an application for managing JetBrains development tools, providing installation, update, and management capabilities. JetBrains Toolbox App suffers from a command injection vulnerability that stems from the SSH plugin handling input improperly. An attacker could exploit t...

CVE-2025-29743

The D-Link DIR-816 A2 wireless router, specifically version A2V1.1.0B05 , is susceptible to a command injection vulnerability within the /goform/delRouting endpoint. This flaw allows a remote attacker to execute arbitrary code on the device. To mitigate this risk, users are urged to update the fi...