4167 matches found
CVE-2025-68154: Improper Neutralization of Special Elements used in an OS Command
systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the fsSize function in systeminformation is vulnerable to OS command injection on Windows systems. The optional drive parameter is directly concatenated into a PowerShell command without...
Exploit for Command Injection in Microsoft
CVE-2025-54100 - PowerShell Response Parsing PoC This reposit...
CVE-2025-67508
gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish and PowerShell, versions 2.11.0 and below of gardenctl allow an attacker with administrative privileges for a Gardener project to craft...
CVE-2025-67508
CVE-2025-67508 affects gardenctl-v2 (gardenctl) ≤ 2.11.0. When used with non-POSIX shells (e.g., Fish, PowerShell), an attacker with administrative Gardener project privileges can craft malicious credential values that cause infrastructure Secret objects to break out of string context, enabling c...
CVE-2025-67508: Improper Neutralization of Special Elements used in a Command
gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish and PowerShell, versions 2.11.0 and below of gardenctl allow an attacker with administrative privileges for a Gardener project to craft...
The vulnerability of PowerShell command interpreters on Windows operating systems allows a hacker to execute arbitrary code.
The vulnerability of PowerShell command interpreters on Windows operating systems is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows an attacker to execute arbitrary code...
gardenctl is vulnerable to Command Injection when used with non‑POSIX shells
A security vulnerability was discovered in gardenctl when it is used with non‑POSIX shells such as Fish and PowerShell. Such setup could allow an attacker with administrative privileges for a Gardener project to craft malicious credential values in infrastructure Secret objects that break out of...
Arbitrary Command Injection
Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the evaluation of credential values in non-POSIX shell environments. An attacker can execute arbitrary commands on the operator's device by crafting malicious credential values in infrastructure Secret...
Arbitrary Command Injection
Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the evaluation of credential values in non-POSIX shell environments. An attacker can execute arbitrary commands on the operator's device by crafting malicious credential values in infrastructure Secret...
PT-2025-50882
Name of the Vulnerable Software and Affected Versions gardenctl versions 2.11.0 and below Description gardenctl is a command-line client for Gardener, used for configuring access to clusters and cloud provider CLI tools. When used with non-POSIX shells like Fish and PowerShell, versions 2.11.0 an...
SureBackup Job Displays Error "PowerShell is not installed on this computer."
Challenge A Veeam Backup & Replication 12.x SureBackup job, utilizing a PowerShell script as part of testing, fails with the error: SureBackup JobName ScriptTests End 'Custom script 1: name $scriptName, failed - PowerShell is not installed on this computer ' Cause This issue occurs for machines...
CVE-2025-54100
Improper neutralization of special elements used in a command 'command injection' in Windows PowerShell allows an unauthorized attacker to execute code locally...
Patch Tuesday - December 2025
Microsoft is publishing a relatively light 54 new vulnerabilities this December 2025 Patch Tuesday, which is significantly lower than we have come to expect over the past couple of years. Today’s list includes two publicly disclosed remote code vulnerabilities, and a single exploited-in-the-wild...
Exploit for CVE-2025-54100
CVE-2026-0386 Powershell's curl uses Invoke-WebRequest u...
CVE-2025-54100
Improper neutralization of special elements used in a command 'command injection' in Windows PowerShell allows an unauthorized attacker to execute code locally...
CVE-2025-54100
Improper neutralization of special elements used in a command 'command injection' in Windows PowerShell allows an unauthorized attacker to execute code locally...
CVE-2025-54100 PowerShell Remote Code Execution Vulnerability
...
CVE-2025-54100
CVE-2025-54100 is a PowerShell RCE vulnerability tied to improper neutralization during MSHTML-based HTML parsing when Invoke-WebRequest is used without -UseBasicParsing. Affected: Windows PowerShell 5.1 on Windows 10/11 and Windows Server 2008–2025; attack is locally exploitable with user intera...
