CVE-2024-48419

Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. Specifically, these issues can be triggered through /goform/tracerouteDiagnosis, /goform/pingDiagnosis, and /goform/fromSysToolPingCmd Each of these issues allows an attacker with access t...

CVE-2024-57595

DLINK DIR-825 REVB 2.03 devices have an OS command injection vulnerability in the CGl interface apcclientpin.cgi, which allows remote attackers to execute arbitrary commands via the parameter "wpspin" passed to the apcclientpin.cgi binary through a POST request...

redis: Redis' Lua library commands may lead to remote code execution

A flaw was found in the Redis server. This flaw allows an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, potentially leading to remote code execution...

The vulnerability of the ASUS AiCloud cloud platform, related to the lack of measures taken to clean data at the management level, allows a perpetrator to execute arbitrary commands.

The vulnerability of the ASUS AiCloud cloud platform lies in the lack of measures taken at the management level to clean data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

PT-2025-4591 · Coolify · Coolify

Name of the Vulnerable Software and Affected Versions: Coolify versions 4.0.0-beta.18 through 4.0.0-beta.252 Description: A vulnerability in the execution of commands on remote servers allows an authenticated user to execute arbitrary code on the local Coolify container, gaining access to data an...

Important: redis6

Issue Overview: Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional...

Amazon Linux 2 : redis (ALASREDIS6-2025-011)

The version of redis installed on the remote host is prior to 6.2.14-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2REDIS6-2025-011 advisory. Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script...

OS Command Injection

Ray is vulnerable to Os command Injection. The vulnerability is due to improper input sanitization in the cpuprofile URL parameter, allowing attackers to execute OS commands remotely on the system running the Ray dashboard without authentication...

The vulnerability in Microsoft Word, Microsoft Office suites, and Microsoft 365 Apps for Enterprise allows a perpetrator to execute arbitrary code.

The vulnerability of Microsoft Word, the Microsoft Office suite, and Microsoft 365 Apps for Enterprise is related to the use of an untrusted pointer. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the Active Directory Federation Server component for the Windows operating system, which allows a attacker to perform a CSRF attack

The vulnerability of the Active Directory Federation Server operating system on Windows is related to the manipulation of cross-site requests. Exploiting this vulnerability can allow a malicious actor to execute a CSRF attack remotely...

PT-2025-1256

Name of the Vulnerable Software and Affected Versions SonicWall SMA 1000 Series versions prior to 12.4.3-02854 Description A critical pre-authentication deserialization of untrusted data vulnerability exists in the SMA1000 Appliance Management Console AMC and Central Management Console CMC...

The vulnerability of the graphical interface of the FortiSandbox system allows a perpetrator to execute arbitrary commands.

The vulnerability of the FortiSandbox threat detection and mitigation graphical interface exists due to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using specially created requests...

The vulnerability of the QuTS operating systems and QTS network devices from Qnap, related to the failure to eliminate CRLF sequences, allows attackers to execute arbitrary code.

The vulnerability of the QuTS operating systems and QTS network devices involves a lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

The vulnerability of the QuTS operating systems and QTS network devices from Qnap, related to the failure to eliminate CRLF sequences, allows attackers to execute arbitrary code.

The vulnerability of the QuTS operating systems and QTS network devices involves a lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

MAL-2025-141 Malicious code in serve-static-corell (npm)

This package includes a post-install script that fetches JavaScript code from a remote server and executes it. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fdac054c93284fd4c0dca285d57baabea075f4c42f7a8bd63abf69f974d56b31 Any computer that has this package install...

Craft CMS 代码注入漏洞

Craft CMS is a content management system CMS open source by Craft CMS. A code injection vulnerability exists in Craft CMS versions 5.0.0-RC1 through prior to 5.5.5 and 4.0.0-RC1 through prior to 4.13.8, which stems from the presence of a security key disclosure, resulting in vulnerability to remo...

VulnCheck KEV: CVE-2025-23209

Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution...

CVE-2024-57784

CVE-2024-57784 targets Zenitel AlphaWeb XE v11.2.3.10, in the component /php/script_uploads.php, enabling a directory traversal. The issue is documented across multiple feeds as an arbitrary file read vulnerability within the web service’s script_uploads.php path. Public exploit activity exists (...

CVE-2025-0356

The CVE-2025-0356 entry concerns NEC Corporation Aterm WX1500HP (version up to 1.4.2) and WX3600HP (version up to 1.5.3). Reported issue: an attacker could execute arbitrary OS commands over the network, i.e., an OS command injection affecting the affected devices. The vulnerability is observed i...

The vulnerability of the Opigno CMS system’s module, related to errors in processing input data during syntax analysis of code, allows attackers to execute arbitrary code.

The vulnerability of the Opigno CMS system’s module is related to errors in data processing during syntax analysis of the code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...