17409 matches found
PT-2025-6262 · Fortinet · Fortiweb
Name of the Vulnerable Software and Affected Versions: Fortinet FortiWeb versions 7.4.0 through 7.6.0 Description: The issue is related to an improper neutralization of special elements used in an os command, also known as 'os command injection'. This allows an attacker to execute unauthorized co...
CVE-2025-1154
CVE-2025-1154 affects xxyopen Novel up to 3.4.1. The /api/front/search/books endpoint is vulnerable due to manipulation of the sort parameter, which leads to SQL injection. The issue can be exploited remotely and the exploit has been disclosed publicly. Multiple sources (Red Hat, NVD/CVE listings...
Azure Linux 3.0 Security Update: mariadb (CVE-2024-0901)
The version of mariadb installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-0901 advisory. - Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of...
CVE-2025-1077
A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products NAMIS, Aero Weather, Satellite Weather. The vulnerability is present in the Product Delivery Service PDS component in specific server configurations where the PDS pipeline utilizes the...
VulnCheck KEV: CVE-2011-2688
SQL injection vulnerability in mysql/mysql-auth.pl in the modauthnzexternal module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field...
CVE-2022-43542
Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete...
CVE-2022-23597
Element Desktop is a Matrix client for desktop platforms with Element Web at its core. Element Desktop before 1.9.7 is vulnerable to a remote program execution bug with user interaction. The exploit is non-trivial and requires clicking on a malicious link, followed by another button click. To the...
CVE-2022-36989
An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 and related NetBackup products. An attacker with authenticated access to a NetBackup Client could remotely execute arbitrary commands on a NetBackup Primary...
CVE-2022-36993
An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 and related NetBackup products. An attacker with authenticated access to a NetBackup Client could remotely execute arbitrary commands on a NetBackup Primary...
CVE-2022-24056
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within th...
CVE-2024-43386
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAILNOTIFICATION.TO in mGuard devices...
CVE-2024-7029
Commands can be injected over the network and executed without authentication...
CVE-2024-12856
The Four-Faith router models F3x24 and F3x36 are affected by an operating system OS command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this...
CVE-2024-3376
A vulnerability classified as critical has been found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part of the file config.php. The manipulation of the argument url leads to execution after redirect. It is possible to initiate the attack remotely. The explo...
CVE-2024-47180
Shields.io is a service for concise, consistent, and legible badges in SVG and raster format. Shields.io and users self-hosting their own instance of shields using version server-2024-09-25 are vulnerable to a remote execution vulnerability via the JSONPath library used by the Dynamic...
CVE-2024-23626
A command injection vulnerability exists in the ‘SaveSysLogParams’ parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed...
CVE-2024-23628
A command injection vulnerability exists in the 'SaveStaticRouteIPv6Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed...
CVE-2024-23627
A command injection vulnerability exists in the 'SaveStaticRouteIPv4Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed...
CVE-2024-54007
Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute arbitrary commands as a privileged...