CVE-2025-56819

An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter...

SolarWinds IT infrastructure management software AjaxProxy Arbitrary Command Execution

The vulnerability of the AjaxProxy component in SolarWinds IT infrastructure management software’s Web Help Desk system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary commands remotely...

CVE-2025-10548 Missing Certificate Validation in CleverControl Installer Allows Remote Code Execution

The CleverControl employee monitoring software v11.5.1041.6 fails to validate TLS server certificates during the installation process. The installer downloads and executes external components using curl.exe --insecure, enabling a man-in-the-middle attacker to deliver malicious files that are...

CVE-2025-26399

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patc...

PT-2025-39176

Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description An authenticated remote code execution RCE issue exists due to improper input validation in the event processor admin service. An attacker with administrative access to the SOAP admin...

ROS-20250923-19

A vulnerability in the Zabbix universal monitoring system is related to insufficient cleaning of user data transmitted via the "Visible Name" field during automatic host deletion. data transmitted via the "Visible Name" field during automatic host deletion. Exploitation vulnerability could allow ...

command-line interface of the

The vulnerability of the command-line interface of the HPE Aruba Networking EdgeConnect SD-WAN software-defined networking solution is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-10800

A weakness has been identified in itsourcecode Online Discussion Forum 1.0. The impacted element is an unknown function of the file /index.php. Executing manipulation of the argument email/password can lead to sql injection. The attack can be executed remotely. The exploit has been made available...

Insecure Deserialization

picklescan is vulnerable to Insecure Deserialization. The vulnerability is due to the use of AutoComplete.getentity to execute remote pickle files, which allows an attacker to run arbitrary code on the target system...

Insecure Deserialization

picklescan is vulnerable to Insecure Deserialization. The vulnerability is due to the use of AutoComplete.fetchcompletions executing remote pickle files, which allows an attacker to run arbitrary code on the system...

LB-Link’s various products have security vulnerabilities

LB-Link BL-AC2100AZ3 and others are a wireless router from China Bilink LB-Link. A security vulnerability exists in various LB-Link products, which originates from an unauthorized command injection in the /goform/setserialcfg interface, which may result in the remote execution of malicious...

Creacast Creabox Manager security vulnerabilities

Creacast Creabox Manager is a device management system from Creacast France. A security vulnerability exists in Creacast Creabox Manager version 4.4.4, which originates in the edit.php endpoint that allows the injection of arbitrary Lua code, which could lead to remote code execution and full...

PT-2025-39007

The LB-Link routers, including the BL-AC2100 AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000 AE4 v2.4.9, BL-AC1900 AZ2 v1.0.2, BL-X26 AC8 v1.2.8, and BL-LTE300 DA4 V1.2.3 models, are vulnerable to unauthorized command injection. Attackers can exploit this vulnerability by accessing the /goform/set serial...

D-link DIR-823X Router Arbitrary Command Execution

The vulnerability of the /goform/diagping file in the microprogramming software for D-link DIR-823X routers is related to the failure to eliminate special elements during the processing of the targetaddr parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary comman...

Dragonfly Database Integer Overflow

The vulnerability of the Dragonfly database is related to a numerical overflow issue. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

CVE-2025-57685: Improper Neutralization of Special Elements used in a Command

The LB-Link routers, including the BL-AC2100AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000AE4 v2.4.9, BL-AC1900AZ2 v1.0.2, BL-X26AC8 v1.2.8, and BL-LTE300DA4 V1.2.3 models, are vulnerable to unauthorized command injection. Attackers can exploit this vulnerability by accessing the /goform/setserialcfg...

Exploit for Improper Input Validation in Drupal

CVE-2018-7600 - Drupal 7 Remote Code Execution !Rusthttps:...

MUD-Manager

This is an offensive tool for IoT devices. It is an exploit module for the Cisco MUD-Manager, which is a technique for constrained end devices to signal to the network what sort of access and network functionality they require to properly function. The tool is designed to exploit vulnerabilities ...

CVE-2025-34195

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 Windows client deployments contain a remote code execution vulnerability during driver installation caused by unquoted program paths. The PrinterInstallerClient driver-installati...

CVE-2025-34202

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 VA and SaaS deployments expose Docker internal networks in a way that allows an attacker on the same external L2 segment — or an attacker able to add routes using the appliance as a...