Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the Command Execution process. An attacker can execute arbitrary commands with the privileges of the server process by leveraging allowed shell commands that can spawn additional commands. This is only...

CVE-2025-52903: Improper Neutralization of Special Elements used in a Command

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions on the 2.x branch prior to 2.33.10, the Command Execution feature of File Browser only allows the execution of shell command which have be...

Malicious code in attributors (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dbefeaf34d3565832f706ae95a143747b2d0ff0a593532a3b8088020fd11bc1d The OpenSSF Package Analysis project identified 'attributors' @ 99.99...

CVE-2023-47295

A CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands via injecting a crafted payload into any text field that accepts strings...

Malicious code in jridgewell-resolve-uri-latest (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ebc214d374220844dddff1ed8dc339282cd98387925c0d108222a3dc578d430 Any computer that has this package installed or running should be considered...

TrustyAI Explainability 操作系统命令注入漏洞

TrustyAI Explainability is an open source TrustyAI toolkit from TrustyAI. TrustyAI Explainability suffers from an operating system command injection vulnerability that stems from command injection and could result in an authenticated user executing arbitrary commands...

CVE-2025-33117

IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 could allow a privileged user to modify configuration files that would allow the upload of a malicious autoupdate file to execute arbitrary commands...

Malicious code in vscode-azurecontainerapps (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5ad54ec265645c2e7358384082a1b1f2385a1caa652b65c359b13681a211b30 Any computer that has this package installed or running should be considered...

Malicious code in zxdb (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b6e6fbdc6289a7a4946e72303aaeb98c9b837470df312ade4e634a7fa81fa52 Any computer that has this package installed or running should be considered...

Malicious code in customdropdownadapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e29bf2cb2ca6349ffa2030e7ae2a9d4f49fb302fc084fb3ace37e76b543b502 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-41362 Code injection vulnerability in IDF and ZLF

Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that...

Malicious code in arc-offsec-custom-library6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05c0ad6a05bb523b5d5f58ae559288cd55c8c2019374a44703101d1efff52f1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4707 Malicious code in virtru-private (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60777031b508b2b27184e7bcdd9afb52ab3ca2e19bda0d7d4dee9333e7ff1190 Any computer that has this package installed or running should be considered...

Malicious code in world-id-poap (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bdb64432a67fa7109c5ee4d1d5b94d0127eaedab876302eb3b246ae55b111498 The OpenSSF Package Analysis project identified 'world-id-poap' @ 1.0...

Malicious code in openkitjs-simple-sample (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b86b90f2ffa63945be2355f5639543a032f0a57ea59dabe377573e35e9d6507b The OpenSSF Package Analysis project identified...

Malicious code in internal-lib-razor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0887160400effb60b7905dc584aa2b213c2c74f7696f2c61b798e64d94ef1fec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-41651

Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system compromise...

CVE-2024-20289

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments for a specific CLI command. An...

CVE-2024-40521

SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is due to the fact that although admintemplate.php imposes certain restrictions on the edited file, attackers can still bypass the restrictions and write code in some way, allowing authenticated attackers to exploit the...

CVE-2024-20296

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit this vulnerability, an attacker would need at least valid Policy Admin credentials on the affected...