CVE-2025-39240

Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command...

PT-2025-25398 · Hikvision · Hikvision Wireless Access Point

Name of the Vulnerable Software and Affected Versions: Hikvision Wireless Access Point affected versions not specified Description: The issue is related to insufficient input validation, allowing authenticated remote command execution. Attackers with valid credentials can exploit this by sending...

The vulnerability of the SSLVPN microprogramming software for network interfaces from SonicWall SMA 100 allows a intruder to execute arbitrary commands.

The vulnerability of the SSLVPN microprogramming software for network interfaces from SonicWall SMA 100 relates to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-1041

An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0...

CVE-2025-49004

Caido is a web security auditing toolkit. Prior to version 0.48.0, due to the lack of protection for DNS rebinding, Caido can be loaded on an attacker-controlled domain. This allows a malicious website to hijack the authentication flow of Caido and achieve code execution. A malicious website load...

CVE-2025-41661

CVE-2025-41661 affects Weidmueller IE-SR-2TX-WL security routers. The vulnerability is a lack of CSRF protection in the main web interface, enabling an unauthenticated remote attacker to execute arbitrary commands with root privileges on affected devices. Several connected sources (Red Hat, NVD, ...

CVE-2025-41662

...

CVE-2025-41662

CVE-2025-41662 entry is rejected/not used and does not represent an active vulnerability.

CVE-2025-41662

...

CVE-2025-46612

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...

CVE-2024-13089

CVE-2024-13089 describes an OS command injection vulnerability in the update functionality of Nozomi Networks Guardian and CMC. The issue allows an authenticated administrator (high-privilege user) to upload update packages, and despite signatures being validated, an improper signature validation...

CVE-2025-1041 Avaya Call Management System RCE vulnerability

An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0...

CVE-2025-1041 Avaya Call Management System RCE vulnerability

An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0...

PT-2025-24659 · Unknown · Airleader Easy +1

Name of the Vulnerable Software and Affected Versions: Airleader Master and Easy versions prior to 6.36 Description: The issue allows remote attackers to execute arbitrary commands via an unrestricted file upload in the Panel Designer dashboard. This can be exploited by logging into the...

CVE-2025-46612

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...

CVE-2025-46612

The CVE-2025-46612 issue affects Airleader Master and Airleader Easy before version 6.36. The Panel Designer dashboard permits unrestricted file uploads via wizard/workspace.jsp, enabling remote command execution when an attacker logs into the administrator console (default credentials are weak) ...

CVE-2025-46612

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...

Avaya Call Management System 安全漏洞

Avaya Call Management System is an integrated analytics and reporting solution from Avaya, Inc. that keeps you informed about virtually everything. A security vulnerability exists in Avaya Call Management System version 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0, which stems from...

CVE-2025-49004 Hijacking Caido instance during the initial setup via DNS Rebinding to achieve RCE

Caido is a web security auditing toolkit. Prior to version 0.48.0, due to the lack of protection for DNS rebinding, Caido can be loaded on an attacker-controlled domain. This allows a malicious website to hijack the authentication flow of Caido and achieve code execution. A malicious website load...

CVE-2025-49004

CVE-2025-49004 affects Caido prior to version 0.48.0. The issue arises from missing DNS rebinding protection, allowing a malicious site to load Caido on an attacker-controlled domain and hijack the authentication flow, potentially enabling remote command execution during the initial setup (and ev...