216 matches found
CVE-2016-15047
CVE-2016-15047 (AVTECH CloudSetup.cgi): Authenticated OS command injection via the exefile parameter in CloudSetup.cgi. The parameter is passed to system command execution without proper validation/whitelisting, enabling an authenticated attacker to run arbitrary commands as root and potentially ...
MAL-2025-48196 Malicious code in redirect-njmr1g (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb773c186456fa674183866972bf820ec532dc4dcd26dec91b2f759364f64081 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-47975 Malicious code in consumerweb-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4eb6a4d25e1e5232ce079c43523de3b71572bb90389aabf0dbebd38837fb89f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2023-54162
Malicious code in bioql PyPI...
EUVD-2025-31157
Malicious code in bioql PyPI...
CVE-2025-59817
This vulnerability allows attackers to execute arbitrary commands on the underlying system. Because the web portal runs with root privileges, successful exploitation grants full control over the device, potentially compromising its availability, confidentiality, and integrity...
CVE-2025-59817
CVE-2025-59817 is an authenticated remote code execution affecting Zenitel ICX500/ICX510 gateways (zForm_auto_config). The vulnerability allows an authenticated attacker to execute arbitrary commands on the device; the web portal runs with root privileges, enabling full control and impacting avai...
CVE-2025-9495
The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By removing specific UI elements, an attack...
PT-2025-39447
Name of the Vulnerable Software and Affected Versions Affected versions not specified Description This issue allows attackers to execute arbitrary commands on the underlying system. Successful exploitation grants full control over the device due to the web portal running with root privileges,...
Zenitel ICX500和Zenitel ICX510 安全漏洞
Zenitel ICX500 and Zenitel ICX510 are both communication and control platforms from Zenitel Norway. A security vulnerability exists in the Zenitel ICX500 and Zenitel ICX510 that originates from an attacker being able to execute arbitrary commands that could result in full control of the device...
Viessmann Vitogate 300 安全漏洞
Viessmann Vitogate 300 is a communication gateway from Viessmann, Germany. A security vulnerability exists in the Viessmann Vitogate 300 that stems from not implementing proper server-side authentication and relying on front-end authentication controls, which could allow an attacker to bypass log...
CVE-2025-9696 Use of Hard-coded Credentials in SunPower PVS6
The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows the...
SunPower PVS6
RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to gain full access to the device, enabling them to replace firmware, modify settings, disable the device, create SSH tunnels, and manipulate attached devices. 2. RECOMMENDED PRACTICES CISA recommends users take...
The vulnerability of the FortiOS operating systems and the FortiProxy proxy server regarding authentication bypass through alternative paths or channels allows attackers to gain full control over the device.
The vulnerability of the FortiOS operating system and the FortiProxy proxy server for protection against Internet attacks involves bypassing the authentication process by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to gain full control over the...
Flaw in Older Version of Android Rooting Tool KernelSU Allows Full Device Takeover
Zimperium's zLabs team uncovers a critical security flaw in the popular Android rooting tool, KernelSU v0.5.7. Learn how…...
The vulnerability in the built-in web server boa (/server/boa.conf) of the TRENDnet TV-IP110WN IP camera software allows a intruder to escalate their privileges and gain full control over the device.
The vulnerability of the built-in web server boa /server/boa.conf of the TRENDnet TV-IP110WN IP camera software is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges and gain full control over the device...
CVE-2025-7768
Tigo Energy's Cloud Connect Advanced CCA device contains hard-coded credentials that allow unauthorized users to gain administrative access. This vulnerability enables attackers to escalate privileges and take full control of the device, potentially modifying system settings, disrupting solar...
CVE-2025-34148
CVE-2025-34148 concerns an unauthenticated OS command-injection in the Shenzhen Aitemi M300 Wi‑Fi Repeater (hardware model MT02) when configured in WISP mode. The vulnerability stems from the unsanitized handling of the ssid parameter being passed to system-level scripts, enabling remote attacker...
CVE-2025-34148 Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via WISP SSID
An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02. When configuring the device in WISP mode, the 'ssid' parameter is passed unsanitized to system-level scripts. This allows remote attackers within Wi-Fi range to inject...
