CVE-2025-25038

An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize user-supplied input before passing it to operating system commands. A remote unauthenticated attacker can exploit this vulnerability to...

CVE-2025-50201

WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was identified in the /html/configuracao/debuginfo.php endpoint. The branch parameter is not properly sanitized before being concatenated and executed in a shell command on the server...

CVE-2025-34024 Edimax EW-7438RPn Mini OS Command Injection via mp.asp

An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint improperly handles user-supplied input to the command parameter. An authenticated attacker can inject shell commands using shell metacharacter...

CVE-2025-6193 Trustyai-explainability: command injection via lmevaljob cr

A command injection vulnerability was discovered in the TrustyAI Explainability toolkit. Arbitrary commands placed in certain fields of a LMEValJob custom resource CR may be executed in the LMEvalJob pod's terminal. This issue can be exploited via a maliciously crafted LMEvalJob by a user with...

CVE-2025-6193

A command injection vulnerability was discovered in the TrustyAI Explainability toolkit. Arbitrary commands placed in certain fields of a LMEValJob custom resource CR may be executed in the LMEvalJob pod's terminal. This issue can be exploited via a maliciously crafted LMEvalJob by a user with...

CVE-2025-50201

WeGIA (web manager for charitable organizations) contains an OS command injection vulnerability in /html/configuracao/debug_info.php where the branch parameter is not sanitized before shell execution. This allows an unauthenticated attacker to run arbitrary commands as the web server user (www-da...

BIT-NODE-2024-3566 Command injection vulnerability in programing languages on Microsoft Windows operating system.

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied...

TP-Link Router Flaw CVE-2023-33538 Under Active Exploit, CISA Issues Immediate Alert

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a high-severity security flaw in TP-Link wireless routers to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The vulnerability in question is CVE-2023-33538 CVSS score: 8.8, a...

TP-Link Multiple Routers Command Injection Vulnerability

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users should discontinue product utilization...

CVE-2025-45984

Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100AZ3 V1.0.4, BL-X10AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200AT1 V1.0.0, BL-X26AC8 V1.2.8, BLAC450MAE4 V4.0.0 and BL-X26DA3 V1.2.7 were discovered to contain a command injection vulnerability via the routepwd parameter in the sub45B238 functio...

CVE-2025-45986

Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 werediscovered to contain a command injection vulnerability via the mac parameter in the bsSetMacBlack function...

CVE-2025-4230

CVE-2025-4230 – PAN-OS command injection via CLI : Multiple connected sources confirm a vulnerability in Palo Alto Networks PAN-OS software where an authenticated administrator with PAN-OS CLI access can bypass restrictions and execute arbitrary root commands. The issue is a local attack with hig...

CVE-2025-4231

Palo Alto Networks PAN-OS is affected by CVE-2025-4231: an authenticated administrative user can execute commands as root via the management Web interface. Exploitation requires network access to the PAN-OS management UI and successful authentication. Cloud NGFW and Prisma Access are not impacted...

D-Link DIR-816 /goform/setipsec_config File Command Injection Vulnerability

The D-Link DIR-816 is a wireless router from China's AUO D-Link. The D-Link DIR-816 suffers from a command injection vulnerability that stems from the parameter localIP/remoteIP in the file /goform/setipsecconfig failing to correctly filter constructed command special characters, commands, and so...

Cisco Unified Communications Command Injection Vulnerability

Cisco Unified Communications is an enterprise call control and session management platform from Cisco that connects people anywhere using any device. A command injection vulnerability exists in Cisco Unified Communications that stems from insufficient validation of command parameters and can be...

TOTOLINK X2000R peerRptPin parameter command injection vulnerability

TOTOLINK X2000R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK X2000R suffers from a command injection vulnerability that stems from the parameter peerRptPin failing to correctly filter constructed command special characters, commands, and so on. No details of the...

CVE-2025-3460

The Quantenna Wi-Fi chipset ships with a local control script, settxpow, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argument Injection'," and is estimated as a CVSS 7.7...

CVE-2025-4653

Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105...

CVE-2025-5945

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2025-49141 HaxCMS-PHP Command Injection Vulnerability

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the gitImportSite functionality obtains a URL string from a POST request and insufficiently validates user input. The setremote function later passes this input into procopen, yielding OS...