CVE-2025-10035 - Critical unauthenticated RCE in GoAnywhere MFT

Overview On September 18, 2025, Fortra published an advisory for CVE-2025-10035. This new vulnerability affects GoAnywhere MFT, an enterprise managed file transfer solution, and allows an attacker to achieve unauthenticated remote code execution. GoAnywhere MFT is a file transfer solution that ha...

CVE-2025-10057

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28. This is due to the writetocustomfile function writing unfiltered PHP code to a file. This makes it possible for authenticated attackers,...

PT-2025-38593

Name of the Vulnerable Software and Affected Versions Vasion Print formerly PrinterLogic Virtual Appliance Host and Application Description The Windows client components PrinterInstallerClientInterface.exe, PrinterInstallerClient.exe, PrinterInstallerClientLauncher.exe lack modern exploit...

PT-2025-38520

Westermo Network Technologies has identified a severe command injection vulnerability in its WeOS 5 operating system that could allow attackers to execute unauthorized commands remotely. Key Points: - A CVSS v4 score of 8.7 indicates a high risk of exploitation. - Remote attackers with...

CVE-2025-48703

CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the ttotal parameter in a filemanager changePerm request. A valid non-root username must be known...

PT-2025-38297

Name of the Vulnerable Software and Affected Versions cbis manager Podman container affected versions not specified Description The cbis manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE,...

CVE-2025-55911

An issue Clip Bucket v.5.5.2 Build90 allows a remote attacker to execute arbitrary codes via the filedownloader.php and the file parameter...

CVE-2025-7996

CVE-2025-7996 affects Ashlar-Vellum Cobalt AR file parsing. The vulnerability is an out-of-bounds write caused by lack of validation when parsing AR files, enabling remote code execution in the context of the affected process. Exploitation requires user interaction (target must visit a malicious ...

CVE-2025-7998

CVE-2025-7998 : In Ashlar-Vellum Cobalt, the CO file parser is vulnerable to an out-of-bounds write caused by insufficient validation of user-supplied data. This can enable remote code execution in the context of the affected process when a user opens a malicious CO file or visits a crafted page....

GHSA-4VR7-G93G-CF6M Duplicate Advisory: Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m4j5-5x4r-2xp9. This link is maintained to preserve external references. Original Description An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314...

CVE-2025-10057

CVE-2025-10057 details from multiple sources confirm a Remote Code Execution flaw in the WordPress plugin “WP Import – Ultimate CSV XML Importer for WordPress” up to version 7.28. The root cause is unfiltered PHP code being written by write_to_customfile(), enabling an authenticated user with Sub...

CVE-2025-58116

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker...

CVE-2025-10589 N-Partner｜N-Reporter, N-Cloud, N-Probe - OS Command Injection

The N-Reporter, N-Cloud, and N-Probe developed by N-Partner has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server...

CVE-2025-10589 N-Partner｜N-Reporter, N-Cloud, N-Probe - OS Command Injection

The N-Reporter, N-Cloud, and N-Probe developed by N-Partner has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server...

I-O DATA WN-7D36QR 操作系统命令注入漏洞

The I-O DATA WN-7D36QR is a wireless router from I-O DATA Japan. The I-O DATA WN-7D36QR suffers from an operating system command injection vulnerability that stems from improper neutralization of special elements, which could lead to remote command execution...

Sequa MCP 操作系统命令注入漏洞

Sequa MCP is an open source MCP protocol entry point for sequa.ai. Sequa MCP 1.0.13 and earlier versions have an operating system command injection vulnerability that originates from the redirectToAuthorization function in the src/helpers/node-oauth-client-provider.ts file in the OAuth Server...

WordPress plugin WP Import – Ultimate CSV XML Importer for WordPress 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability exists in th...

PT-2025-38107

Name of the Vulnerable Software and Affected Versions: WN-7D36QR WN-7D36QR/UE Description: An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A remote authenticated attacker may be able to execute arbitrary OS commands. Recommendations: ...

DataEase 代码问题漏洞

DataEase is an open source data visualization and analysis tool from DataEase Open Source. It is used to help users quickly analyze data and gain insight into business trends for business improvement and optimization. A code issue vulnerability exists in DataEase 2.10.12 and prior versions that...

CVE-2025-10402

A flaw has been found in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /admin/readenq.php. Executing manipulation of the argument delid can lead to sql injection. The attack can be executed remotely. The exploit has been published and may...