📄 aaPanel 7.x.x Remote Command Execution

aaPanel version 7.x.x suffers from an authenticated remote command execution vulnerability. This was discovered prior and noted in CVE-2020-14421 where it states that it affects versions 6.6.6 and below. The developers claim it is patched but it still affects the 7.x.x version. This is...

Linksys E5600 runtime.ddnsStatus() Command Execution

The vulnerability of the runtime.ddnsStatus function in Linksys E5600 router microprogramming software is related to the lack of measures taken to neutralize special elements used in the operating system’s command for processing the username parameter. Exploiting this vulnerability allows a remot...

SilentSync RAT Delivered via Two Malicious PyPI Packages Targeting Python Developers

Cybersecurity researchers have discovered two new malicious packages in the Python Package Index PyPI repository that are designed to deliver a remote access trojan called SilentSync on Windows systems. "SilentSync is capable of remote command execution, file exfiltration, and screen capturing,"...

CVE-2023-49565

The cbismanager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without...

CVE-2023-49565

The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. The root cause is the improper sanitization of the X-FILENAME , X-PAGE , and X-FIELD HTTP headers, which are directly utilized within the subprocess.Popen Python function without adequate va...

WAVLINK WL-WN578W2 Sub Function Arbitrary Command Execution

The vulnerability of the sub401340 function /cgi-bin/login.cgi of the WAVLINK WL-WN578W2 signal booster software is related to the failure to take measures to neutralize special elements during the processing of the ipaddr parameter. Exploiting this vulnerability allows a remote attacker to execu...

CVE-2023-49565: Improper Neutralization of Special Elements used in a Command

The cbismanager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without...

D-Link DIR-845L Router Command Execution

The vulnerability of the soapcgimain function in D-Link DIR-845L router microprogramming software is related to the lack of measures taken to clean data at the control level when processing the pcVar3 parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

TOTOLINK A3300R Router Command Execution

The vulnerability of the setDmzCfg function in TOTOLINK A3300R router microprogramming software is related to the lack of measures taken to neutralize special elements used in the operating system’s commands when processing the ip parameter. Exploiting this vulnerability allows a remote attacker ...

WAVLINK WL-WN578W2 Sub Function Arbitrary Command Execution

The vulnerability of the sub409184 function /wizardrep.shtml of the WAVLINK WL-WN578W2 signal booster software is related to the failure to take measures to neutralize special elements during the processing of the selEncrypTyp parameter. Exploiting this vulnerability allows a remote attacker to...

TOTOLINK X6000R Sub Function Arbitrary Command Execution

The vulnerability of the sub417D74 function in the microprogrammed software of TOTOLINK X6000R routers is related to the lack of measures taken to clean data at the control level when processing the parameter filename. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

TOTOLINK X6000R Sub 410118 Arbitrary Command Execution

The vulnerability of the sub410118 function in the microprogrammed operating system of TOTOLINK X6000R relates to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

TOTOLINK EX1200T Main Function Command Execution

The vulnerability of the main function in TOTOLINK EX1200T microcontroller-based routers lies in the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-9972

Certain models of Industrial Cellular Gateway developed by Planet Technology have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the device...

SUSE SLES15: libpcp-devel / libpcp3 / libpcp_gui2 / libpcp_import1 / libpcp_mmv1 / etc (SUSE-SU-2025:03233-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:03233-1 advisory. - CVE-2024-3019: exposure of the redis server backend allows remote command execution via pmproxy bsc1222121. Tenable has extracted the...

CVE-2025-37126 Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface

A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as...

HPE Aruba Networking EdgeConnect SD-WAN Gateways security vulnerabilities

HPE Aruba Networking EdgeConnect SD-WAN Gateways is an edge gateway appliance from HPE America. A security vulnerability exists in HPE Aruba Networking EdgeConnect SD-WAN Gateways, which stems from flaws in the encryption logic that could lead to the execution of arbitrary commands by an...

Totolink A3002R Router Arbitrary Command Execution

The vulnerability of the bupload.html component in the Totolink A3002R router microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Totolink N600R SetWiFiWpsConfig Command Execution

The vulnerability of the setWiFiWpsConfig function in the Totolink N600R router’s microprogramming software is related to the lack of measures taken to neutralize special elements during the processing of the pin parameter. Exploiting this vulnerability allows a remote attacker to execute arbitra...

Fastwel PLC Command Injection Privilege Escalation

The vulnerability of the built-in software of the PLC Fastwel is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary operating system commands and elevate their...