CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2021-20035link is external SonicWall SMA100 Appliances OS Command Injection Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyb...

Security Bulletin: Multiple Security Vulnerabilites were discovered in the IBM Verify Directory Server Container (CVE-2024-49814, CVE-2024-51450)

Summary Security Vulnerabilities have been addressed in the IBM Security Verify Directory Server Container. Vulnerability Details CVEID:CVE-2024-49814 DESCRIPTION: IBM Security Verify Access Appliance could allow a locally authenticated user to increase their privileges due to execution with...

Security Bulletin: Security vulnerabilities discovered in IBM Security Directory Suite (CVE-2024-45650, CVE-2024-51540) have been addressed.

Summary Security vulnerabilities discovered in IBM Security Directory Suite have been addressed. Vulnerability Details CVEID:CVE-2024-45650 DESCRIPTION: IBM Security Verify Directory 10.0 through 10.0.3 is vulnerable to a denial of service when sending an LDAP extended operation. CWE:CWE-754:...

Security Bulletin: Multiple vulnerabilities in IBM webMethods Integration

Summary An authenticated developer user can utilize webMethods Integration Server to create a user through the scheduler service and then elevate that user to an administrator using runAsUser. This action provides elevated privileges for the developer user. webMethods Integration Server could...

ABB Cylon Aspect 3.08.02 (uploadDb.php) - Remote Code Execution

ABB Cylon Aspect 3.08.02 uploadDb.php - Remote Code Execution Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.02 Summary: ASPECT is an award-winning scalable building energy management and...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via a specific php artisan command at the /admin/compass endpoint. An attacker can execute arbitrary OS commands by injecting arguments into the command execution process. This is only exploitable if the...

DevDojo Voyager Argument Injection vulnerability

DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command...

OpenPanel 0.3.4 - OS Command Injection

Exploit Title: OpenPanel 0.3.4 - OS Command Injection Date: Nov 25, 2024 Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee Vendor Homepage: https://openpanel.com/ Software Link: https://openpanel.com/ Version: 0.3.4 Tested on: macOS CVE : CVE-2024-53584 POST /server/timezon...

PT-2025-16258 · Devdojo +1 · Devdojo Voyager +1

Name of the Vulnerable Software and Affected Versions: DevDojo Voyager versions 1.4.0 through 1.8.0 Description: The issue allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command when Laravel 8 or later is used. Recommendations: For DevDojo Voyager...

Adobe ColdFusion OS Command Injection Vulnerability

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion has an OS command injection vulnerability that can be exploited by an attacker to...

CVE-2025-32931

DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command...

CVE-2025-32107

OS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 ProJPV11.1.2 Build 20250123". If this vulnerability is exploited, an arbitrary OS command may be executed by the user who can log in to the device...

Exploit for OS Command Injection in Php

CVE-2024-4577 usage: CVE-2024-4577.py -h -v RHOST RPO...

CVE-2025-25053

OS command injection vulnerability in the WEB UI the setting page exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product...

CVE-2025-27797

OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product...

CVE-2025-32107

OS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 ProJPV11.1.2 Build 20250123". If this vulnerability is exploited, an arbitrary OS command may be executed by the user who can log in to the device...

CVE-2025-32107

OS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 ProJPV11.1.2 Build 20250123". If this vulnerability is exploited, an arbitrary OS command may be executed by the user who can log in to the device...

CVE-2025-32107

CVE-2025-32107 affects TP-Link Deco BE65 Pro firmware pre-1.1.1.2 Build 20250123 (JP). The flaw is an OS command injection in the device’s software, allowing an authenticated user who can log in to execute arbitrary OS commands. Impact is described as total compromise of the device’s command exec...

CVE-2025-32107

OS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 ProJPV11.1.2 Build 20250123". If this vulnerability is exploited, an arbitrary OS command may be executed by the user who can log in to the device...

PT-2025-16038 · Tp Link · Deco Be65 Pro

Name of the Vulnerable Software and Affected Versions: Deco BE65 Pro versions prior to Deco BE65 ProJP V1 1.1.2 Build 20250123 Description: The issue is related to an OS command injection vulnerability. If exploited, it allows a user who can log in to the device to execute an arbitrary OS command...