193428 matches found
EUVD-2025-211070
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $... in the UVR5 WebUI output folder textboxes with mp3 or m4a export...
CVE-2025-71429 GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $... in the UVR5 WebUI output folder textboxes with mp3 or m4a export...
CVE-2025-71429
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $... in the UVR5 WebUI output folder textboxes with mp3 or m4a export...
CVE-2025-71429 GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $... in the UVR5 WebUI output folder textboxes with mp3 or m4a export...
CVE-2025-71429 GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $... in the UVR5 WebUI output folder textboxes with mp3 or m4a export...
CVE-2025-71429
Versions of GPT-SoVITS up to and including 20250606v2pro are vulnerable to an OS command injection vulnerability in the tools/uvr5/vr.py component. The root cause is the improper neutralization of special elements, allowing unauthenticated attackers to execute arbitrary commands as the server use...
CVE-2020-37279 easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $ ...
CVE-2020-37279
The easy-pdf-merge library, versions 0.1.0 through 0.2.6 , is vulnerable to an OS command injection vulnerability. The flaw exists because the software fails to properly sanitize shell metacharacters—such as double quotes, semicolons, $(), or backticks—when processing the source path , destinatio...
CVE-2020-37279
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $ ...
EUVD-2020-31276
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $ ...
CVE-2020-37279 easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $ ...
[SECURITY] [DSA 6556-1] nagios4 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6556-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 12, 2026 https://www.debian.org/security/faq -...
CVE-2026-81494
Summary Incus extracts a unified image's top-level files straight into the instance directory, and later writes to two of those paths as root without checking for symlinks: "backup.yaml" at instance create and "network/resolv.conf" at OCI container start. An imported image can ship those names as...
CVE-2026-59774
Summary An unauthenticated remote attacker can submit Org-mode markup containing a +INCLUDE directive to POST /owner/repo/markup for any suitable public repository to read arbitrary server files. By extracting INTERNALTOKEN from app.ini, they can inject a Git hook through the internal logger and...
EUVD-2026-97779
PHPCSUtils is a suite of utility functions for use with PHPCodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey evaluates attacker-controlled array-key expressions with eval, allowing callback-form keys in untrusted PHP code scanne...
CVE-2026-6232
An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer...
CVE-2026-108917
A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclos...
CVE-2026-108918
A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The...
CVE-2026-108916
A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and...
CVE-2026-108918
A command injection vulnerability exists in the Edimax BR-6208AC (version 1.32) within an unknown function of the /goform/formWlanMP file. An attacker can trigger this vulnerability remotely by manipulating the readE2P argument. The vulnerability impacts products that are no longer supported by t...