PT-2025-50668

Name of the Vulnerable Software and Affected Versions Ruijie X30-PRO versions X30-PRO-V1 09241521 Description An OS Command Injection issue exists in Ruijie X30-PRO version X30-PRO-V1 09241521. Attackers can execute arbitrary commands by sending a specially crafted POST request to the module get...

CVE-2025-56088

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the actionservice in file /usr/lib/lua/luci/controller/admin/service.lua...

CVE-2025-56077

OS Command Injection vulnerability in Ruijie RG-RAP2200E 247 2200 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devsta/nbrcwmp.lua...

CVE-2025-56077

OS Command Injection vulnerability in Ruijie RG-RAP2200E 247 2200 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devsta/nbrcwmp.lua...

CVE-2025-56086

OS Command Injection vulnerability in Ruijie RG-EW1200 EW3.01B11P227EW120011130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleget in file /usr/local/lua/devsta/networkConnect.lua...

CVE-2025-56083

OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V109241521 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devsta/nbrnetworkIdmerge.lua...

CVE-2025-56102

CVE-2025-56102 affects Ruijie RG-EW1800GX (B11P226_EW1800GX_10223121). The vulnerability is an OS Command Injection via crafted POST to /usr/local/lua/dev_sta/networkConnect.lua: module_get, caused by unverified input. Impact per sources: arbitrary command execution with network access. Remediati...

CVE-2025-56101

OS Command Injection vulnerability in Ruijie M18 EW3.01B11P226M1810223116 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleget in file /usr/local/lua/devsta/networkConnect.lua...

CVE-2025-56101

CVE-2025-56101 affects Ruijie M18 EW, specifically the file /usr/local/lua/dev_sta/networkConnect.lua’s module_get. The vulnerability is an OS Command Injection that can allow an attacker to execute arbitrary commands via a crafted POST request. Reported impacted version: Ruijie M18 EW_3.0(1)B11P...

CVE-2025-56091

CVE-2025-56091 is an OS Command Injection affecting Ruijie RG-EW1800GX (B11P226_EW1800GX_10223121). An attacker can trigger arbitrary command execution via a crafted POST to /usr/local/lua/dev_config/config_retain.lua (module_set). The CVSS 3.1 base score is 8.8 (HIGH) with network attack vector,...

CVE-2025-56079

Ruijie RG-EW1300G/EW1300G (V1.00, V2.00, V4.00) are affected. The vulnerability is an OS Command Injection in the /usr/local/lua/dev_sta/networkConnect.lua module_get function, exploitable via a crafted POST request to run arbitrary commands (remote, network-based). Root cause is unsafe handling ...

CVE-2025-56117

Summary: CVE-2025-56117 is an OS Command Injection in Ruijie X30-PRO (X30-PRO-V1_09241521). The flaw allows an attacker to execute arbitrary commands by sending a crafted POST request to the module_set handler in the file /usr/local/lua/dev_sta/nbr_cwmp.lua. What is affected: Ruijie X30-PRO devic...

CVE-2025-56095

Ruijie RG-EW1200G PRO devices (V1.00–V4.00) are reported vulnerable to OS Command Injection via an crafted POST to module_set in /usr/local/lua/dev_sta/nbr_cwmp.lua. Root cause is unverified/unsafely handled input in nbr_cwmp.lua, enabling arbitrary command execution with network access. Affected...

CVE-2025-56086

CVE-2025-56086 affects Ruijie RG-EW1200 devices (EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00). The issue is an OS command injection in the module_get function inside /usr/local/lua/dev_sta/networkConnect.lua, exploitable via a crafted POST request to that path. This could allow an attacker to...

CVE-2025-56089

CVE-2025-56089 describes an OS Command Injection in Ruijie M18 EW firmware version 3.0(1)B11P226 M18 10223116. The flaw allows an attacker to execute arbitrary commands by sending a crafted POST request to the module_set handler in /usr/local/lua/dev_sta/nbr_cwmp.lua. Public sources (NVD/Red Hat/...

EUVD-2025-202742

OS Command Injection vulnerability in Ruijie M18 EW3.01B11P226M1810223116 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devsta/nbrcwmp.lua...

Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands...

GHSA-V8HG-M323-JVJQ Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands...

CVE-2025-53679

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1,...

EUVD-2025-202284

A vulnerability in NETGEAR Nighthawk R7000P routers lets an authenticated admin execute OS command injections due to improper input validation. This issue affects R7000P: through 1.3.3.154...