FortiSandbox Graphical Interface Command Execution

The vulnerability of the FortiSandbox threat detection and mitigation graphical interface exists due to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using specially created requests...

MAL-2025-141 Malicious code in serve-static-corell (npm)

This package includes a post-install script that fetches JavaScript code from a remote server and executes it. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fdac054c93284fd4c0dca285d57baabea075f4c42f7a8bd63abf69f974d56b31 Any computer that has this package install...

Craft CMS code injection vulnerability

Craft CMS is a content management system CMS open source by Craft CMS. A code injection vulnerability exists in Craft CMS versions 5.0.0-RC1 through prior to 5.5.5 and 4.0.0-RC1 through prior to 4.13.8, which stems from the presence of a security key disclosure, resulting in vulnerability to remo...

VulnCheck KEV: CVE-2025-23209

Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution...

CVE-2024-57784

The Zenitel AlphaWeb XE version v11.2.3.10 is vulnerable to an authenticated directory traversal issue within the /php/script_uploads.php component. This vulnerability allows an attacker to perform directory traversal to read arbitrary files on the application service. Proof-of-concept (PoC) code...

CVE-2025-0356

The CVE-2025-0356 entry concerns NEC Corporation Aterm WX1500HP (version up to 1.4.2) and WX3600HP (version up to 1.5.3). Reported issue: an attacker could execute arbitrary OS commands over the network, i.e., an OS command injection affecting the affected devices. The vulnerability is observed i...

Windows Telephony Service Code Execution

The vulnerability of the Windows operating system’s Telephony Service is related to overflowing buffers in the dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Opigno CMS Code Execution

The vulnerability of the Opigno CMS system’s module is related to errors in data processing during syntax analysis of the code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-13162

SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-32848...

CVE-2025-21291

CVE-2025-21291 is a Windows Direct Show remote code execution vulnerability. Documented CVSSv3.1 shows high risk (8.8) with network exploitation requiring user interaction. Affected: Windows DirectShow components; root cause specifics not disclosed in provided materials. Microsoft has released se...

CVE-2025-21171 .NET Remote Code Execution Vulnerability

...

CVE-2024-57471

The H3C N12 wireless router, specifically version V100R005 , contains a buffer overflow vulnerability. This flaw stems from a lack of length verification in the 2.4G wireless network processing function. A remote attacker can exploit this by sending a POST request to the /bin/webs endpoint, poten...

CVE-2024-57473

The H3C N12 wireless router (version V100R005 ) is susceptible to a buffer overflow vulnerability caused by a lack of length verification in the mac address editing function . A remote attacker can exploit this by sending a POST request to the /bin/webs endpoint, potentially leading to a device c...

Ivanti CVE-2025-0282 Checker

This script allows you to safely scan and test to see if you are vulnerable to CVE-2025-0282, a stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 that allows a...

CVE-2024-57473

H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the mac address editing function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST request to...

Ivanti EPM data falsification vulnerability

Ivanti EPM is a one-stop-shop for managing user profiles and all client devices from Ivanti, USA. Ivanti EPM is vulnerable to a data forgery issue vulnerability that stems from the inclusion of an improper signature verification issue. Allowing a remote unauthenticated attacker to exploit the...

Wavlink AC3000 adm.cgi set_TR069() command injection vulnerability

Talos Vulnerability Report TALOS-2024-2028 Wavlink AC3000 adm.cgi setTR069 command injection vulnerability January 14, 2025 CVE Number CVE-2024-21797 SUMMARY A command execution vulnerability exists in the adm.cgi setTR069 functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HT...

QNAP Symlink Remote Code Execution

The QNAP operating system suffers from a symlinking vulnerability. It is possible to upload a symlink trough a ZIP file and abuse the encrypt/decrypt function to gain an arbitrary file write primitive which can be turned into remote code execution. An attacker with privileges of a regular user ca...

System Component Code Execution

The vulnerability of the System component of the Android operating system is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability

BeyondTrust Privileged Remote Access PRA and Remote Support RS contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execut...