CVE-2024-35517

Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usbremotesmbconf.cgi via the sharename parameter...

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-45195link is external Apache OFBiz Forced Browsing Vulnerability CVE-2024-29059link is external Microsoft .NET Framework Information Disclosure Vulnerability...

CVE-2024-55062

Code Injection vulnerability in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote unauthenticated attackers to execute arbitrary code to /api/license/sendlicense/...

CVE-2024-53584

OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter...

CVE-2024-53615

A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted video file...

CVE-2025-20014 mySCADA myPRO Manager OS Command Injection

mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system...

CVE-2025-22606 Coolify Command Injection Vulnerability in Project Name

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes...

TOTOLINK A810R Command Injection Vulnerability (CNVD-2025-02379)

The TOTOLink A810R is a wireless dual-band router from China's TotoLink. The TOTOLINK A810R suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands by sending HTTP requests...

Fortinet FortiVoice Operating System Command Injection Vulnerability

Fortinet FortiVoice is a network communications solution from Fortinet, Inc. Fortinet FortiVoice suffers from an operating system command injection vulnerability that arises from an improper neutralization of special elements used in operating system commands, which can be exploited by an attacke...

TOTOLINK X5000R setVpnAccountCfg function desc parameter command injection vulnerability

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. The TOTOLINK X5000R suffers from a command injection vulnerability, which stems from the "desc" parameter in setVpnAccountCfg failing to properly filter constructed command special characters, commands, etc. This vulnerabilit...

TOTOLINK X5000R setScheduleCfg Function Minute Parameter Command Injection Vulnerability

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. The TOTOLINK X5000R suffers from a command injection vulnerability that stems from the "minute" parameter in setScheduleCfg failing to properly filter constructed command special characters, commands, etc. This vulnerability...

TOTOLINK X5000R week parameter command injection vulnerability in setWiFiScheduleCfg function

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X5000R version V9.1.0cu.2350B20230313, which stems from the "week" parameter in setWiFiScheduleCfg failing to correctly filter constructed command special characters,...

WAVLINK AC3000 Command Injection Vulnerability (CNVD-2025-08334)

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. The WAVLINK AC3000 suffers from a command injection vulnerability that originates from the touchlistsync.cgi touchlistsync function failing to correctly filter constructed command special characters, commands, etc. An attacker could u...

TOTOLINK X5000R setVpnAccountCfg function user parameter command injection vulnerability

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. The TOTOLINK X5000R suffers from a command injection vulnerability that stems from the "user" parameter in setVpnAccountCfg failing to properly filter constructed command special characters, commands, etc. This vulnerability...

WAVLINK AC3000 Command Injection Vulnerability (CNVD-2025-09263)

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. The WAVLINK AC3000 suffers from a command injection vulnerability that arises from the wireless.cgi AddMac function failing to properly filter special characters, commands, etc. used to construct commands. An attacker can exploit this...

TOTOLINK X5000R sMinute Parameter Command Injection Vulnerability in the setWiFiScheduleCfg Function

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in TOTOLINK X5000R version V9.1.0cu.2350B20230313, which stems from the "sMinute" parameter in setWiFiScheduleCfg failing to correctly filter constructed command special characters,...

CVE-2024-57583

Tenda AC18 V15.03.05.19 was discovered to contain a command injection vulnerability via the usbName parameter in the formSetSambaConf function...

CVE-2025-22906

RE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName parameter at /goform/setWAN...

CVE-2025-0457

The airPASS from NetVision Information has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands...

CVE-2024-57015

TOTOLINK X5000R is affected by CVE-2024-57015. The vulnerability is an OS command injection via the hour parameter in setScheduleCfg on version V9.1.0cu.2350_B20230313, caused by inadequate filtering of constructed command characters. Impact is described as arbitrary command execution with high s...