CVE-2025-70328

TOTOLINK X6000R v9.4.0cu.1498B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable. The hosttime parameter is retrieved via sub40C404 and passed to a date -s shell command through CsteSystem. While the first two tokens of the...

CVE-2025-66259

Authenticated RCE vulnerability in DB Electronica Mozart FM Transmitter family (versions 30–7000) due to improper input filtering in main_ok.php where user-supplied hour/time data is passed directly to a date shell command. Root cause: insufficient input validation allowing remote code execution ...

CVE-2025-66259: Improper Input Validation

Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform in mainok.php user supplied data/hour/time is passed directl...