CVE-2025-58180

CVE-2025-58180 affects OctoPrint ≤ 1.11.2. An authenticated attacker able to upload files can craft a filename that, when interpolated into a system event handler command, leads to arbitrary command execution on the host via a FileAdded event. The vulnerability relies on insufficient sanitization...

CVE-2025-24404: XML Injection (aka Blind XPath Injection)

XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat. The attacker needs to have an authenticated account with access, and add monitor parsed by xml, returned special content can trigger the XML parsing vulnerability. This issue affects Apache HertzBeat incubatin...

CVE-2025-58371

CVE-2025-58371 affects Roo Code (versions ≤ 3.26.6). A GitHub workflow used unsanitized pull request metadata in a privileged context, enabling an attacker to craft input that caused Remote Code Execution (RCE) on the Actions runner. The runner’s broad permissions and access to repository secrets...

@vdart-code/web (1.19.0), @wix/cloud-provider-fetch-adapter (>=1.0.1, <=1.0.5) +11 more potentially affected by CVE-2025-58179 via @astrojs/cloudflare (>=11.2.0, <=12.6.3)

@astrojs/cloudflare NPM version =11.2.0, =1.0.1, =0.37.0, =0.37.0, =0.32.7, =0.32.7, =0.32.7, =0.1.0, =0.1.0, =0.2.1, =0.2.1, =0.0.11, =1.0.37, =1.1.3 Source cves: CVE-2025-58179 Source advisory: OSV:GHSA-QPR4-C339-7VQ8...

CVE-2025-56803: Improper Neutralization of Special Elements used in an OS Command

Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands by setting a crafted build field in the plugin's manifest.json. This field is passed to childprocess.exec without validation, leading to...

Metasploit Weekly Wrap-Up 08/28/2025

New module content 2 Pretalx Arbitrary File Read/Limited File Write Authors: Stefan Schiller and msutovsky-r7 Type: Auxiliary and Exploit Pull request: 20480 contributed by msutovsky-r7 Path: auxiliary/scanner/http/pretalxfilereadcve202328459 and exploit/linux/http/pretalxrcecve202328458 Attacker...

Malicious code in deepmountains-rce (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-41659 Malicious code in deepmountains-rce (PyPI)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-54762: Unrestricted Upload of File with Dangerous Type

SS1 Ver.16.0.0.10 and earlier Media version:16.0.0a and earlier allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges...

@jill64/svelte-dark-theme (>=2.3.65, <=5.1.7), @jill64/svelte-i18n (>=1.1.27, <=2.2.1) +9 more potentially affected by CVE-2025-57820 via devalue (>=5.0.0, <=5.1.1)

devalue NPM version =5.0.0, =2.3.65, =1.1.27, =1.1.21, =1.2.263, =2.2.3, =0.0.2-dev.84, =1.0.23, =1.0.22, =1.0.0, =1.0.6, =2.1.10, =2.1.15 Source cves: CVE-2025-57820 Source advisory: SNYK:JS-DEVALUE-12205530...

CVE-2025-57772: Improper Control of Generation of Code

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC URL meets criteria, the getJdbcUrl method is returned, which acts as the getter for the JdbcUrl parameter provided. This bypasses H2's...

CVE-2025-57760: Improper Privilege Management

Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command langflow superuser to create a new administrative user. This results in...

Windows Remote Desktop Gateway RCE (CVE-2020-0609)

A remote code execution vulnerability exists in Windows Remote Desktop Gateway RD Gateway when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who...

Commvault Command-Line Argument Injection to Traversal Remote Code Execution

This module exploits an unauthenticated remote code execution exploit chain for Commvault, tracked as CVE-2025-57790 and CVE-2025-57791. A command-line injection permits unauthenticated access to the 'localadmin' account, which then facilitates code execution via expression language injection...

CVE-2025-54473: Unrestricted Upload of File with Dangerous Type

An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the unzip feature...

CVE-2025-54466: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used. Even unauthenticated attackers can exploit this vulnerability. Users are recommended t...

Malicious code in jh-rce-package (npm)

The package jh-rce-package was found to contain malicious code...

MAL-2025-23790 Malicious code in jh-rce-package (npm)

The package jh-rce-package was found to contain malicious code...

CVE-2025-54382 Cherry Studio RCE Vulnerability Disclosure

Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution RCE vulnerability exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. The issue arises from the server’s implicit trust in the oauth auth redirecti...

CVE-2025-55164 content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE

content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called proto, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves...