1885 matches found
CVE-2025-35004
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argument...
CVE-2025-32455
The Quantenna Wi-Fi chipset ships with a local control script, routercommand.sh in the runcmd argument, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argument Injection'," and is estimated as a CVSS 7.7...
CVE-2024-13087
A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version:...
CVE-2025-22481 QTS, QuTS hero
A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...
CVE-2024-13087
CVE-2024-13087 affects QNAP QHora/Qurouter devices. A command injection flaw exists in the router OS, enabling a user with local network access and an administrator account to cause arbitrary code execution via the miro_webserver_lib_RunExecBash path (poor input validation). Impact is described a...
PT-2025-24292 · Qnap · Qnap Quts Hero +1
Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.2.4.3079 build 20250321 QNAP QuTS hero versions prior to h5.2.4.3079 build 20250321 Description: A command injection issue has been reported, affecting several QNAP operating system versions. This could allow remo...
Cisco Unified Communications Manager Command Injection (cisco-sa-vos-command-inject-65s2UCYy)
According to its self-reported version, Cisco Unified Communications Manager is affected by a command injection vulnerability. - A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlyin...
CVE-2025-5620
DVE- CVE-2025-5620 affects D-Link DIR-816. The vulnerability is in the function setipsec_config (file /goform/setipsec_config) where manipulation of localIP/remoteIP leads to OS command injection. Remote exploitation is possible, and vulnerability affects firmware 1.10CNB05; the issue is tied to ...
Netcomm NTC 6200和Netcomm NWL 222 命令注入漏洞
The Netcomm NTC 6200 and Netcomm NWL 222 are both routers from Netcomm Australia. A security vulnerability exists in the Netcomm NTC 6200 and Netcomm NWL 222 that stems from command injection and hard-coded passwords that could lead to arbitrary code execution...
ASUS RT-AX55 Routers OS Command Injection Vulnerability
ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346...
CVE-2025-5277
CVE-2025-5277 affects the aws-mcp-server MCP server. The vulnerability is a command injection where an attacker can craft a prompt that, when accessed by the MCP client, will cause arbitrary commands to run on the host. The NVD metrics indicate a CRITICAL impact (CVSSv4.0 9.4; CVSSv3.1 9.6) with ...
CVE-2025-1753 Command Injection in LLama-Index CLI in run-llama/llama_index
LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the --files argument, which is directly passed into os.system. An attacker who controls the content of this argument can inject and execute arbitrary shell...
PT-2025-23327 · Undefined · Undefined
CVE-2022-44614 - Apache HTTP Server Command Injection CVE ID : CVE-2022-44614 Published : May 28, 2025, 7:15 p.m. | 2 hours, 16 minutes ago Description : Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused Severity: 0.0 | NA Visit the li...
WAVLINK WL-WN579A3 /cgi-bin/qos.cgi Component Command Injection Vulnerability
WAVLINK WL-WN579A3 is a high performance dual-band wireless card from China RuiYin WAVLINK. The WAVLINK WL-WN579A3 suffers from a command injection vulnerability that originates from unfiltered input in the /cgi-bin/qos.cgi component, no details of the vulnerability are provided at this time...
PT-2025-22976 · Apache · Apache Struts
Name of the Vulnerable Software and Affected Versions: Apache Struts affected versions not specified Description: The issue concerns a command injection problem. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issu...
PT-2025-23651 · Totolink · Totolink X2000R
Name of the Vulnerable Software and Affected Versions: TOTOLINK X2000R version 1.0.0-B20230726.1108 Description: A critical issue has been found in the software, affecting some unknown functionality of the file /boafrm/formMapDel. The manipulation of the argument devicemac1 leads to command...
CVE-2025-5146 Netcore NBR200V2 HTTP Header routerd passwd_set command injection
A vulnerability has been found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2 and NBR200V2 up to 20250508 and classified as critical. This vulnerability affects the function passwdset of the file /usr/bin/routerd of the component HTTP Header Handler. The manipulation of the...
CVE-2025-22905
RE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter at /goform/mp...
CVE-2024-52019
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at geniefix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...