CVE-2025-13942

A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17ABUP.15.1C0 could allow a remote attacker to execute operating system OS commands on an affected device by sending specially crafted UPnP SOAP requests...

Cisco Catalyst SD-WAN Manager (Cisco SD-WAN vManage) authorization issue vulnerability

Cisco Catalyst SD-WAN Manager is a highly customizable dashboard provided by Cisco. It simplifies and automates the deployment, configuration, management, and operation of Cisco SD-WAN. There is an authorization vulnerability in Cisco Catalyst SD-WAN Manager, which stems from improper API...

BMC IPMI Web Interface Auth Bypass Command Execution

The vulnerability of the BMC IPMI web interface is related to access control errors. Exploiting this vulnerability allows a malicious actor to bypass authentication and execute arbitrary commands remotely...

D-Link DI-8200G Router Command Execution

The vulnerability of the /upgradefilter.asp file in D-Link DI-8200G router microprogramming software exists due to the failure to take measures to neutralize special elements in the output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

FreePBX endpoint Code Execution

The vulnerability of the “endpoint” web interface module in the IP telephony system management software FreePBX is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

D-Link doSystem() Command Execution

The vulnerability of the doSystem/setSystemAdmin function in D-Link DCS-931L microprogrammed security cameras is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

D-link DIR-823X Router Web Management Interface Command Execution

The vulnerability of the /goform/setacserver file in the Web Management Interface component of the D-link DIR-823X router microprogramming system is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

D-link DIR-823X Router Command Execution

The vulnerability of the sub4211C8 function /goform/setfiltering of the D-link DIR-823X router’s microprogramming system is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

D-link DIR-823X Router Command Execution

The vulnerability of the /goform/setpassword function in the D-link DIR-823X router microprogramming system is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

📄 FUX 1.2.8 Authentication Bypass / Remote Command Execution

This Python exploit targets CVE-2025-69985, an authentication bypass in FUXA web-based SCADA/HMI software that allows access to the protected /api/runscript endpoint even when authentication is enabled. By sending a crafted JavaScript payload using childprocess.execSync, it achieves full remote...

📄 Frigate NVR 0.16.3 Remote Command Execution

This Python exploit targets a critical configuration manipulation vulnerability in Frigate NVR versions up to 0.16.3 both authenticated and unauthenticated paths. By injecting a malicious go2rtc stream and a fake camera entry, it triggers arbitrary command execution as the Frigate process during...

CVE-2026-3102 exiftool PNG File MacOS.pm SetMacOSTags os command injection

A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be...

CVE-2026-27483

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the...

CVE-2026-27483

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the...

Malicious code in request-httpx-9 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d8547656202b4eac0d914d466c2fe1d3bf17210c63af75ac2d8e020f5d0ef28c The package contains a Telegram bot running allowing for remote access. This functionality is disclosed in the readme, but the package name clearly indicates...

CVE-2025-13942

A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17ABUP.15.1C0 could allow a remote attacker to execute operating system OS commands on an affected device by sending specially crafted UPnP SOAP requests...

CVE-2025-13942

CVE-2025-13942 affects Zyxel EX3510-B0 devices with firmware up to 5.17(ABUP.15.1)C0, where the UPnP function is vulnerable to command injection via specially crafted UPnP SOAP requests, enabling remote OS command execution. The cited sources provide the vulnerability details and CVSS 3.1 score (...

CVE-2025-13942

A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17ABUP.15.1C0 could allow a remote attacker to execute operating system OS commands on an affected device by sending specially crafted UPnP SOAP requests...

CVE-2026-27483: Improper Limitation of a Pathname to a Restricted Directory

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the...

Trendnet TEW-814DAP Form System Check Command Execution

The vulnerability of the /formSystemCheck file of Trendnet’s wireless access points, the TEW-814DAP device, is related to insufficient checking of the argumenipipv4ping/ipv6ping, which is passed in the command. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...