httpd-demon Arbitrary Command Execution

The vulnerability of the httpd-demon /goform/SetSysTimeCfg in the Tenda AC21 router microprogramming system is related to the operation of writing data beyond the buffer in memory when processing parameters for time and timeZone. Exploiting this vulnerability allows a remote attacker to execute...

Zenitel TCIV-3+ IP video door phones Command Injection

The vulnerability of the microprogrammed software of the Zenitel TCIV-3+ IP video door phones is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Remote Command Execution

scio-pypi is vulnerable to Remote Command Execution. The vulnerability is due to torch.load executing unsafe deserialization even when weightsonly=True, which allows an attacker to craft malicious model files that trigger arbitrary code execution during loading...

Remote Command Execution

n8n and n8n-nodes-base are vulnerable to Remote Command Execution. The vulnerability is due to the Execute Command node allowing arbitrary command execution on the host system, which allows an attacker to exploit insufficient user trust controls to run malicious commands leading to system...

D-link DIR-878A1 Router SetDMZSettings Function Command Execution

The vulnerability of the SetDMZSettings function in the prog.cgi script of the D-link DIR-878A1 router microprogramming system is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

D-link DIR-878A1 Router SetNetworkSettings Command Execution

The vulnerability of the SetNetworkSettings function in the prog.cgi script of the D-link DIR-878A1 router’s microprogramming system is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary comman...

CVE-2025-64127: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to execute arbitrary commands remotely...

NIM Server Arbitrary Command Execution

The vulnerability of the NIM server for the IBM AIX and IBM VIOS operating systems is related to improper process management. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CLSA-2025-1764080949 pcp: Fix of CVE-2024-3019

CVE-2024-3019: Fix default pmproxy configuration to restrict access to Redis server backend, preventing remote command execution...

Linux IGEL OS Command Injection

The vulnerability of the Linux-based IGEL OS for end devices is related to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Tenda AC23 Router Arbitrary Command Execution

The vulnerability of the saveParentControlInfo function in the Tenda AC23 router’s microprogramming software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

Instantel Micromate Authentication Bypass Command Execution

The vulnerability of Instantel Micromate software is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

GL.iNet Path Traversal

The vulnerability of the microprogrammed software of the GL.iNet MT6000, A1300, X300B, AX1800, AXT1800, MT2500, MT3000, X3000, XE3000, XE300, E750, X750, SFT1200, AR300M, AR300M16, AR750, AR750S, B1300, MT1300, MT300N-V2, AP1300, B2200, MV1000, MV1000W, USB150, SF1200, N300, S1300 lies in the...

Tenda AC21 Router Command Execution

The vulnerability of the formSetPPTPServer function in the Tenda AC21 router microprogramming system lies in the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

D-Link DSP-W110A1 Router CookieHandler Arbitrary Command Execution

The vulnerability of the CookieHandler component in D-Link’s DSP-W110A1 router microprogramming software is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-12740

CVE-2025-12740 affects Looker where a user with Developer role could create a DB2 database connection and, by manipulating LookML, cause Looker to execute a malicious command due to inadequate filtering of the IBM DB2 driver’s parameters. Concrete details across multiple sources confirm the vulne...

CVE-2025-12740 Remote Command Execution in Looker via IBM DB2 JDBC drive

A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious command, due to inadequate filtering of the driver's parameters. Looker-hosted and Self-hosted were found to be vulnerable. This issue has...

Nagios Log Server Arbitrary Command Execution

The vulnerability of the Natural Language Queries function in the Nagios Log Server monitoring and analysis software is related to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2025-47964

Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware used by many white-labeled DVR/NVR/IPC products contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor...

MAL-2025-191760 Malicious code in hooktest1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b3e91d71ab21e3575f1354593a314d50bc188b0db7b3851040e522426a765417 During installation, the package starts a code to retrieve and execute commands from Discord --- Category: MALICIOUS - The campaign has clearly malicious inten...