4249 matches found
CVE-2024-45354
CVE-2024-45354 affects the Xiaomi shop application (product) where the root cause is improper input validation in a code path handling user-supplied data, enabling potential remote code execution. The CVSS 3.1 metrics indicate Network access with low attack complexity, no privileges required, use...
CVE-2024-45352
An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code...
CVE-2024-45352 Xiaomi smarthome application Webview has code execution vulnerability
An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code...
CVE-2024-45352 Xiaomi smarthome application Webview has code execution vulnerability
An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code...
CVE-2024-45352
CVE-2024-45352 affects the Xiaomi Smarthome application. A code execution vulnerability exists due to improper input validation in the internal API parser. The connected exploit document provides a PoC showing unauthenticated RCE via a crafted request to the local API (curl to /api/parse), implyi...
CVE-2025-29635
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/setprohibiting via the corresponding function, triggering remote command execution...
PT-2025-13026 · Xiaomi · Xiaomi Smarthome Application
Name of the Vulnerable Software and Affected Versions: Xiaomi smarthome application affected versions not specified Description: A code execution issue exists due to improper input validation, allowing attackers to execute malicious code. Recommendations: At the moment, there is no information...
The vulnerability of the sub_410C80() function in the cstecgi.cgi script of the TOTOLINK X18 router’s microprogramming system, which allows a hacker to execute arbitrary commands.
The vulnerability of the sub410C80 function in the cstecgi.cgi script of the TOTOLINK X18 router’s microprogramming system is related to the lack of data cleaning measures at the control level when processing the mtkhnatEnable parameter. Exploiting this vulnerability allows an attacker to execute...
CVE-2024-45351 Game center application has code execution Vulnerability
A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code...
CVE-2024-45351
CVE-2024-45351 affects Xiaomi Game Center app. Connected documents indicate the flaw is due to improper input validation, enabling code execution. The risk details from CVSS v3.1 show LOCAL attack vector, LOW attack complexity, and user interaction required, with all three impact metrics (confide...
CVE-2025-26003
Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution vulnerability when requesting the admin.cgi parameter with setAutorest...
CVE-2025-2531
Luxion KeyShot DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visi...
CVE-2025-2531 Luxion KeyShot DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Luxion KeyShot DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visi...
PT-2025-12839 · Carlinkit · Carlinkit Cpc200-Ccpa
Name of the Vulnerable Software and Affected Versions: CarlinKit CPC200-CCPA affected versions not specified Description: The issue is related to an improper verification of cryptographic signature, which can lead to code execution. Recommendations: At the moment, there is no information about a...
LoLLMS Code Injection vulnerability
A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's eval function to evaluate mathematical expressions within a Python sandbox that disables builtins and only allows functions from the math module...
CVE-2024-7764 SQL Injection in vanna-ai/vanna
Vanna-ai v0.6.2 is vulnerable to SQL Injection due to insufficient protection against injecting additional SQL commands from user requests. The vulnerability occurs when the generatesql function calls extractsql with the LLM response. An attacker can include a semi-colon between a search data fie...
CVE-2024-12029
Summary: CVE-2024-12029 affects invoke-ai/invokeai prior to 5.4.3, via unsafe deserialization in the /api/v2/models/install API, leading to remote code execution when loading model files through torch.load. Affected software: invoke-ai/invokeai, versions 5.3.1 through 5.4.2 (and up to 5.4.2 per s...
CVE-2025-27780 Applio allows unsafe deserialization in model_information.py
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in modelinformation.py. modelname in modelinformation.py takes user-supplied input e.g. a path to a model and pass that value to the runmodelinformationscript and later to modelinformation...
CVE-2024-10442
CVE-2024-10442 affects Synology Replication Service and Synology Unified Controller (DSMUC). The vulnerability is an off-by-one error in the transmission component that can allow remote attackers to execute arbitrary code. Affected versions include Replication Service before 1.0.12-0066, 1.2.2-03...