17382 matches found
CVE-2024-58280
CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. Attackers can append ',php' to Extensionsuserfiles and upload a shell script to the media directory to execute arbitrary code on the server...
CVE-2024-58284
CVE-2024-58284 affects PopojiCMS 2.0.1. Descriptions across multiple sources indicate an authenticated remote command execution vulnerability that lets an administrative user inject malicious PHP code via the metadata settings endpoint. An attacker who can log in can modify meta content to create...
Command Execution Vulnerability in Multimedia Integrated Service Display System of Beijing Shenzhou Vision Han Technology Co., Ltd (CNVD-C-2025-1018960)
Ltd. is a deep-rooted enterprise in the field of visualization. A command execution vulnerability exists in the multimedia integrated business display system of Beijing Divine Vision Han Technology Co. Ltd, which can be exploited by attackers to remotely execute commands...
📄 Xorcom CompletePBX 5.2.35 Remote Code Execution
Xorcom CompletePBX suffers from an authenticated command injection vulnerability within the Task Scheduler subsystem. An attacker with valid superadmin credentials can create a scheduled task containing unsanitized parameters that get executed by the backend, resulting in remote command execution...
CVE-2025-34406 MailEnable < 10.54 Reflected XSS in Id Parameter of Mobile/ContactDetails.aspx
MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the Id parameter of /Mobile/ContactDetails.aspx. The Id value is not properly sanitized when processed via a GET request and is reflected within a block in the response. By supplying a crafted payload...
CVE-2025-34404 MailEnable < 10.54 Reflected XSS in InstanceScope Parameter of CAL/compose.aspx
MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the InstanceScope parameter of /Mondo/lang/sys/Forms/CAL/compose.aspx. The InstanceScope value is not properly sanitized when processed via a GET request and is reflected inside a block in the...
CVE-2025-62561
CVE-2025-62561 is Microsoft Excel remote code execution due to an untrusted pointer dereference in Office Excel. The vulnerability affects Microsoft Excel as part of the Office suite; exploitation would allow code execution on a local host. Connected advisories confirm the issue in Excel and list...
EUVD-2025-202246
Untrusted pointer dereference in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to execute code over a network...
Arbitrary Code Injection
Overview neuron-core/neuron-ai is a The PHP Agentic Framework. Affected versions of this package are vulnerable to Arbitrary Code Injection via the validation based on the first keyword e.g., SELECT and a forbidden-keyword list does not block file-writing constructs such in the MySQLSelectTool. A...
CVE-2025-10573
Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required...
CVE-2025-13662
CVE-2025-13662 concerns Ivanti Endpoint Manager’s patch management component. The flaw is improper verification of cryptographic signatures, allowing a remote unauthenticated attacker to execute arbitrary code in the context of the target. The impact is high: remote code execution with user inter...
Microsoft Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally...
Description of the security update for SharePoint Server 2019: December 9, 2025 (KB5002816)
None None...
CVE-2025-14208
A security flaw has been discovered in D-Link DIR-823X up to 20250416. This affects the function sub415028 of the file /goform/setwansettings. The manipulation of the argument pppusername results in command injection. It is possible to launch the attack remotely. The exploit has been released to...
KB5071503: Windows Server 2012 R2 Security Update (December 2025)
The remote Windows host is missing security update 5071503. It is, therefore, affected by multiple vulnerabilities - Untrusted pointer dereference in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to execute code over a network. CVE-2025-62549 - Heap-based buffer...
Exploit for CVE-2025-66478
CVE-2025-66478 – Next.js Server Actions RCE Vulnerability: Ana...
The vulnerability of the Android operating system library libimagecodec.quram.so in Samsung mobile devices allows a hacker to execute arbitrary code.
The vulnerability of the Android operating system’s libimagecodec.quram.so library in Samsung mobile devices is related to writing beyond the buffer boundaries of memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
PT-2025-49583
Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable remote code execution RCE...
RHEL 8 : redis:6 (RHSA-2025:19238)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19238 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...