CVE-2025-63215

The Sound4 IMPACT web-based management interface is vulnerable to Remote Code Execution RCE via a malicious firmware update package. The update mechanism fails to validate the integrity of manual.sh, allowing an attacker to inject arbitrary commands by modifying this script and repackaging the...

PT-2025-47352

Name of the Vulnerable Software and Affected Versions Fortinet FortiExtender versions 7.0 all versions Fortinet FortiExtender versions 7.2 all versions Fortinet FortiExtender versions 7.4.0 through 7.4.6 Fortinet FortiExtender versions 7.6.0 through 7.6.1 Description An issue exists in Fortinet...

Fortinet FortiWeb 安全漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. A security vulnerability exists in Fortinet...

PT-2025-47365

Name of the Vulnerable Software and Affected Versions FortiPAM versions 1.0 through 1.6.0 Description A cleartext storage of sensitive information in memory issue exists in FortiPAM. An authenticated attacker with read-write administrative privileges to the command-line interface CLI may be able ...

PT-2025-47237

Name of the Vulnerable Software and Affected Versions Zyxel DX3300-T0 firmware versions prior to 5.50ABVY.6.3C0 Description A post-authentication command injection issue exists in the priv parameter. Successful exploitation allows an authenticated attacker to execute operating system OS commands ...

phpMyFAQ < 4.0.14 SQLi Vulnerability (GHSA-fxm2-cmwj-qvx4)

phpMyFAQ is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyfaq:phpmyfaq"; if...

HPE Aruba Networking Management Software 安全漏洞

HPE Aruba Networking Management Software is a network management platform from HPE America. A security vulnerability exists in HPE Aruba Networking Management Software Airwave that stems from a command injection vulnerability in the command line interface that could lead to the execution of...

Linksys E1200 Command Injection Vulnerability

The Linksys E1200 is a router from Linksys USA. The Linksys E1200 suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the device...

CVE-2025-63227

The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unrestricted file upload vulnerability in the /patch.php endpoint. An attacker with administrative credentials can upload arbitrary files e.g., PHP webshells, which are stored in the /patch/ directory. This...

D-Link DIR-823G Command Injection Vulnerability (CNVD-2025-30949)

The D-Link DIR-823G is a wireless router from China's AUO D-Link. The D-Link DIR-823G suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the device...

The vulnerability of the Netty network programming framework lies in the lack of measures taken to clean data at the management level, allowing attackers to execute arbitrary SMTP commands.

The vulnerability of the Netty network programming framework is related to the lack of measures taken to sanitize data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary SMTP commands...

MAL-2025-190550 Malicious code in transparent-example-request99 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6678163799dc68caa6452a201456bd093435349d000df2dd5895fbf7b0067b5 The package transparent-example-request99 was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-34322

Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature. When this feature is configured, certain user-controlled settings—including model selection and connection parameters—are read from the...

EUVD-2025-197845

Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability via the experimental 'Natural Language Queries' feature. Configuration values for this feature are read from the application settings and incorporated into a system command without adequate...

CVE-2025-34322 Nagios Log Server < 2026R1.0.1 Authenticated Command Injection via Natural Language Queries

Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature. When this feature is configured, certain user-controlled settings—including model selection and connection parameters—are read from the...

CVE-2025-58407 GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet

Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trigger a read and/or write of data outside the allotted memory escaping the virtual machine...

CVE-2025-58407 GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet

Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trigger a read and/or write of data outside the allotted memory escaping the virtual machine...

Malicious code in node-calculator-4e41 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13eeb23685dac84d542d197d77303c42cf1157c465348c204b391edca71c782d The package node-calculator-4e41 was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190520 Malicious code in node-calculator-4e41 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13eeb23685dac84d542d197d77303c42cf1157c465348c204b391edca71c782d The package node-calculator-4e41 was found to contain malicious code. Source: ghsa-malware...

Malicious code in node-calculator-0f50 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37cd604b28cb577df0057a572f81e0fbda0029eb9017abcdea709811fefbc3d7 The package node-calculator-0f50 was found to contain malicious code. Source: ghsa-malware...