EUVD-2025-23014

Totolink X6000R V9.4.0cu.1360B20241207 was found to contain a command injection vulnerability in the sub4184C0 function via the tz parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request...

CVE-2025-52284

Totolink X6000R V9.4.0cu.1360B20241207 was found to contain a command injection vulnerability in the sub4184C0 function via the tz parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request...

GO-2025-3773 Ackites KillWxapkg vulnerable to OS Command Injection in github.com/Ackites/KillWxapkg

Ackites KillWxapkg vulnerable to OS Command Injection in github.com/Ackites/KillWxapkg...

CVE-2025-54418 CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagick handler for image processing imagick as the image library and either allow file uploads with user-controlled filenames and process...

CVE-2025-8259

CVE-2025-8259 affects Vaelsys 4.1.0. The vulnerability is an OS command injection in the function execute_DataObjectProc of the file /grid/vgrid_server.php, caused by manipulation of the xajaxargs argument. It can be triggered remotely, and public exploits have been disclosed; vendor responses ar...

CVE-2025-54416 tj-actions/branch-names Contains Command Injection Vulnerability

tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 and below, a critical vulnerability has been identified in the tj-actions/branch-names' GitHub Action workflow which allows arbitrary comma...

CVE-2025-54416

CVE-2025-54416 – tj-actions/branch-names has a concrete command-injection flaw in the GitHub Action outputs. The vulnerability stems from unsafe use of the pattern echo "... $(eval printf "%s" …)" to populate GITHUB_OUTPUT, allowing an attacker-controlled branch or tag name to inject commands dow...

tj-actions/branch-names has a Command Injection Vulnerability

Overview A critical vulnerability has been identified in the tj-actions/branch-names GitHub Action workflow which allows arbitrary command execution in downstream workflows. This issue arises due to inconsistent input sanitization and unescaped output, enabling malicious actors to exploit special...

Command Injection

@translated/lara-mcp is vulnerable to command injection. The vulnerability is due to unsanitized input passed to childprocess.exec, which allows an attacker to inject and execute arbitrary system commands through shell metacharacters...

CVE-2025-43020

A potential command injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a privileged user to submit arbitrary input. HP has addressed the issue in the latest software update...

CVE-2025-7723

A command injection vulnerability exists that can be exploited after authentication in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407...

CVE-2025-7404 Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 Nicolette; Autocaliweb: from 0.7.0 before 0.7.1...

CVE-2025-43020

A potential command injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a privileged user to submit arbitrary input. HP has addressed the issue in the latest software update...

CVE-2025-43020

CVE-2025-43020 affects the Poly Clariti Manager prior to 10.12.2. The vulnerability is a command injection risk where a privileged user could submit arbitrary input through the manager, potentially leading to command execution. Multiple sources identify Poly Clariti Manager versions

CVE-2025-7723 Authenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2

A command injection vulnerability exists that can be exploited after authentication in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407...

CVE-2025-7723

CVE-2025-7723 affects TP-Link VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2. The OS command injection vulnerability can be exploited after authentication, with affected builds: V1 before 1.1.5 (Build 250518) and V2 before 1.3.1 (Build 250407). Related vendor advisories (JPN/JP and PTSecurity) cor...

PT-2025-30474 · Unknown · Vigi Nvr1104H-4P V1 +1

Name of the Vulnerable Software and Affected Versions: VIGI NVR1104H-4P V1 versions prior to 1.1.5 Build 250518 VIGI NVR2016H-16MP V2 versions prior to 1.3.1 Build 250407 Description: A command injection vulnerability exists that can be exploited after authentication. Recommendations: Update VIGI...

CVE-2025-53832

CVE-2025-53832 affects the Lara Translate MCP Server package (@translated/lara-mcp). Versions ≤0.0.11 are vulnerable due to unsanitized user input passed to child_process.exec, enabling shell metacharacter injection and potential remote code execution under the MCP server process. Connected advis...

CVE-2025-7382

Summary (CVE-2025-7382) : A command-injection vulnerability exists in the WebAdmin component of Sophos Firewall versions older than 21.0 MR2 (21.0.2). If OTP authentication for the admin user is enabled, adjacent attackers can achieve pre-auth code execution on High Availability (HA) auxiliary de...

CVE-2025-7382

A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to adjacent attackers achieving pre-auth code execution on High Availability HA auxiliary devices, if OTP authentication for the admin user is enabled...