EUVD-2025-208493

A Stack-based Buffer Overflow vulnerability CWE-121 vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.10, FortiManager 6.4 all versions may allow a remote unauthenticated attacker to execute unauthorized commands via crafted requests, if the service is...

CVE-2025-54820

Fortinet FortiManager contains a Stack-based Buffer Overflow (CWE-121) affecting FortiManager 7.4.0–7.4.2, 7.2.0–7.2.10, and all 6.4 versions. An unauthenticated remote attacker could craft requests to execute unauthorized commands if the service is enabled. The flaw is related to bypassing stack...

Fortinet FortiManager Buffer overflow via fgtupdates service (FG-IR-26-098)

The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-098 advisory. - A Stack-based Buffer Overflow vulnerability CWE-121 in FortiManager fgtupdates service may allow a remote unauthenticate...

MAL-2026-1290 Malicious code in remjsonparse (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e478d1e016f1d6d6d1cb4a9d23ac45449c22d99aa8e71c88d2f38fae8951f23f During import, package starts advanced compromise actions: exfiltrates AWS and git credentials, commands history, security tools in use. After that, the code...

Malicious code in remjsonparse (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e478d1e016f1d6d6d1cb4a9d23ac45449c22d99aa8e71c88d2f38fae8951f23f During import, package starts advanced compromise actions: exfiltrates AWS and git credentials, commands history, security tools in use. After that, the code...

CVE-2026-3661 Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection

A flaw has been found in Wavlink WL-NU516U1 240425. This affects the function otanewupgrade of the file /cgi-bin/adm.cgi. This manipulation of the argument model causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor wa...

PT-2026-23781

Name of the Vulnerable Software and Affected Versions XikeStor SKS8310-8X Network Switch versions prior to 1.04.B07 Description The XikeStor SKS8310-8X Network Switch contains an OS command injection issue in the /goform/PingTestSet API endpoint. Unauthenticated remote attackers can execute...

NewStart CGSL MAIN 6.06 (SP) : vim Vulnerability (NS-SA-2026-0010)

The remote NewStart CGSL host, running version MAIN 6.06 SP, has vim packages installed that are affected by a vulnerability: - getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated...

pgAdmin 4 Command Execution

The vulnerability of the pgAdmin 4 database management tool is related to access control errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

TOTOLINK X6000R NTPSyncWithHost Handler Command Execution

The vulnerability of the NTPSyncWithHost handler in the /usr/sbin/shttpd executable of the X6000R router microprogramming system exists due to the lack of measures taken to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to...

TOTOLINK X5000R setIptvCfg Command Execution

The vulnerability of the setIptvCfg handler in the /usr/sbin/lighttpd executable file of the TOTOLINK X5000R router microprogramming system exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a...

TOTOLINK N300RH Set WebWlanIdx Command Execution

The vulnerability of the setWebWlanIdx function in the microprogrammed software of TOTOLINK N300RH routers is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

📄 Juniper JunosEvolved Remote Command Execution

This Metasploit module exploits an unauthenticated command injection vulnerability in the Juniper JunosEvolved API. The exploit workflow involves creating a custom command entity, mapping it to a Directed Acyclic Graph DAG, and triggering an execution instance. The module uses a non-destructive...

Unity Linux 20.1060e / 20.1070e Security Update: atril (UTSA-2026-005397)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005397 advisory. Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in...

CVE-2025-52365

A command injection vulnerability in the szc script of the ccurtsinger/stabilizer repository allows remote attackers to execute arbitrary system commands via unsanitized user input passed to os.system. The vulnerability arises from improper input handling where command-line arguments are directly...

D-link DIR-823X Sub Process Arbitrary Command Execution

The vulnerability of the sub420688 /goform/setqos function in D-link DIR-823X router microprogramming software is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by sending specially craft...

D-Link DIR-600 B5 Router ssdp.cgi Command Execution

The vulnerability of the ssdp.cgi file of the D-Link DIR-600 B5 router’s microprogramming system is related to insufficient checking of arguments passed in the command when processing the parameters HTTPST/REMOTEADDR/REMOTEPORT/SERVERID. Exploiting this vulnerability allows a remote attacker to...

Tenda W20E doSystemCmd Command Execution

The vulnerability of the doSystemCmd goform/formSetUSBPartitionUmount function in the Tenda W20E router microprogramming system is related to incorrect handling of code generation in memory when processing the usbPartitionName parameter. Exploiting this vulnerability allows an attacker to execute...

Tenda AC15 Sub B0488 Function Arbitrary Command Execution

The vulnerability of the subB0488 function goform/formSetIptv in the microprogramming software for Tenda AC15 is related to incorrect handling of code generation in memory when processing the parameter s11. Exploiting this vulnerability can allow an attacker to execute arbitrary commands remotely...

Tenda W20E Router Arbitrary Command Execution

The vulnerability of the addWewifiWhiteUser function in the goform/formAddWewifiWhiteUser function of the Tenda W20E router’s microprogramming software is related to the execution of operations outside the buffer in the userInfo parameter’s memory. Exploiting this vulnerability could allow a remo...