CVE-2025-27078

CVE-2025-27078 affects HPE AOS-8 Instant and AOS-10 AP — a vulnerability in a system binary that could allow an authenticated remote attacker to inject commands into the underlying operating system via the CLI, potentially leading to complete system compromise. The NVD/NVD-derived metrics indicat...

CVE-2025-3361

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

CVE-2025-3363

CVE-2025-3363 affects HGiga’s iSherlock web service. The vulnerability is an OS command injection in the web service, allowing unauthenticated remote attackers to inject and execute arbitrary system commands on the server. Affected: iSherlock web service; root cause is improper handling of input ...

CVE-2025-3363 HGiga iSherlock - OS Command Injection

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

HPE Aruba Networking AOS-8 Instant AP and AOS-10 AP Multiple Vulnerabilities

Potential Security Impact: Remote: Arbitrary Command Execution, Unauthorized Arbitrary Command Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba 100 Series Access Points See vulnerability summary for affected versions Aruba 103 Series Access Points See vulnerability...

📄 Appsmith Remote Code Execution

An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

mangle platform Executable Command Execution

The vulnerability of the mangle platform’s executable file for application deployment and management related to buffer overflow in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary system commands by sending specially crafted HTTP requests remotely...

CVE-2025-29987

Dell PowerProtect Data Domain with Data Domain Operating System DD OS versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root...

CVE-2021-47667

An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters in the tmpname parameter when dropping off a file via a POST /dropoff request...

PT-2025-15052 · Zendto · Zendto

Name of the Vulnerable Software and Affected Versions: ZendTo versions 5.24-3 through 6.x before 6.10-7 Description: An OS command injection issue in lib/NSSDropoff.php allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters in the tmp name parameter when...

Juniper Networks J-Web Arbitrary Command Execution

The vulnerability in the J-Web management web interface of Juniper Networks Junos OS relates to the failure to neutralize data in XPath expressions. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

BIT-APPSMITH-2024-55964

An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacker must be able to access Appsmith, login to it, create a datasource, create a query against that...

Netgear WNR854T cmd.cgi Command Injection

The vulnerability in the cmd.cgi script of Netgear WNR854T router microprogramming software relates to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

FortiSandbox GUI Arbitrary Command Execution

The vulnerability of the GUI component of the FortiSandbox threat detection and mitigation system exists because measures to neutralize its special elements have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Netgear WNR854T AddPortMapping Command Execution

The vulnerability of the AddPortMapping method in Netgear WNR854T router microprogramming software lies in the lack of measures to neutralize special elements used in the operating system’s commands when processing the NewInternalClient parameter. Exploiting this vulnerability allows a remote...

FortiSandbox GUI Arbitrary Command Execution

The vulnerability of the GUI component of the FortiSandbox threat detection and mitigation system is related to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Netgear WNR854T Router Command Execution

The vulnerability of the web interface of Netgear WNR854T router software lies in the lack of measures to neutralize special elements used in the operating system’s commands when processing the wanhostname parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

FortiSandbox GUI Arbitrary Command Execution

The vulnerability of the GUI component of the FortiSandbox threat detection and mitigation system exists because measures to neutralize its special elements have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-2071

CVE-2025-2071 pertains to the FAST LTA Silent Brick WebUI, where an OS command injection vulnerability exists due to improper handling of untrusted input passed to system-level commands. The flaw affects WebUI input handling for parameters such as “hd” and “pi” and could allow remote attackers to...

CVE-2025-2071 OS Command Injection Vulnerability in FAST LTA Silent Brick WebUI

A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This vulnerability arises due to improper handling of untrusted input, which is passed direct...