The vulnerability of the NIM server for the IBM AIX and IBM VIOS operating systems allows attackers to execute arbitrary commands.

The vulnerability of the NIM server for the IBM AIX and IBM VIOS operating systems is related to improper process management. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the SetDMZSettings() function in the prog.cgi script of the D-link DIR-878A1 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the SetDMZSettings function in the prog.cgi script of the D-link DIR-878A1 router microprogramming system is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

The vulnerability of the SetNetworkSettings() function in the prog.cgi script of the D-link DIR-878A1 router’s software allows a hacker to execute arbitrary commands.

The vulnerability of the SetNetworkSettings function in the prog.cgi script of the D-link DIR-878A1 router’s microprogramming system is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary comman...

CLSA-2025-1764080949 pcp: Fix of CVE-2024-3019

CVE-2024-3019: Fix default pmproxy configuration to restrict access to Redis server backend, preventing remote command execution...

The vulnerability of Instantel Micromate software lies in the lack of authentication for a critical function, allowing attackers to execute arbitrary commands.

The vulnerability of Instantel Micromate software is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the formSetPPTPServer function in the Tenda AC21 router software allows a hacker to execute any command they desire.

The vulnerability of the formSetPPTPServer function in the Tenda AC21 router microprogramming system lies in the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the operating system for end devices based on Linux IGEL OS, related to the failure to take measures to neutralize special elements used in the operating system’s commands, allows a perpetrator to execute arbitrary commands.

The vulnerability of the Linux-based IGEL OS for end devices is related to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the CookieHandler component in D-Link’s DSP-W110A1 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the CookieHandler component in D-Link’s DSP-W110A1 router microprogramming software is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the microprogrammed software of the GL.iNet MT6000, A1300, X300B, AX1800, AXT1800, MT2500, MT3000, X3000, XE3000, XE300, E750, X750, SFT1200, AR300M, AR300M16, AR750, AR750S, B1300, MT1300, MT300N-V2, AP1300, B2200, MV1000, MV1000W, USB150, SF1200, N300, S1300 lies in the incorrect limitation on the path name to the restricted access directory. This allows attackers to execute arbitrary commands.

The vulnerability of the microprogrammed software of the GL.iNet MT6000, A1300, X300B, AX1800, AXT1800, MT2500, MT3000, X3000, XE3000, XE300, E750, X750, SFT1200, AR300M, AR300M16, AR750, AR750S, B1300, MT1300, MT300N-V2, AP1300, B2200, MV1000, MV1000W, USB150, SF1200, N300, S1300 lies in the...

The vulnerability of the `saveParentControlInfo` function in the Tenda AC23 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the saveParentControlInfo function in the Tenda AC23 router’s microprogramming software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

CVE-2025-12740

CVE-2025-12740 affects Looker where a user with Developer role could create a DB2 database connection and, by manipulating LookML, cause Looker to execute a malicious command due to inadequate filtering of the IBM DB2 driver’s parameters. Concrete details across multiple sources confirm the vulne...

CVE-2025-12740 Remote Command Execution in Looker via IBM DB2 JDBC drive

A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious command, due to inadequate filtering of the driver's parameters. Looker-hosted and Self-hosted were found to be vulnerable. This issue has...

PT-2025-47964

Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware used by many white-labeled DVR/NVR/IPC products contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor...

The vulnerability of the Natural Language Queries function in the Nagios Log Server monitoring and analysis software allows a perpetrator to execute arbitrary commands.

The vulnerability of the Natural Language Queries function in the Nagios Log Server monitoring and analysis software is related to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

MAL-2025-191760 Malicious code in hooktest1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b3e91d71ab21e3575f1354593a314d50bc188b0db7b3851040e522426a765417 During installation, the package starts a code to retrieve and execute commands from Discord --- Category: MALICIOUS - The campaign has clearly malicious inten...

CVE-2025-65946

Roo Code (AI-powered coding agent) had a validation error before version 3.26.7 that could cause it to automatically execute commands not on the allowed prefixes list. The issue has been patched in version 3.26.7. Affected CVE-2025-65946 entries from multiple feeds confirm the vulnerability and p...

The vulnerability of the command_test.php script of the Core Config Manager component of the Nagios XI monitoring tool allows a hacker to execute arbitrary commands.

The vulnerability of the commandtest.php script of the Core Config Manager component of the Nagios XI monitoring tool is related to the failure to take measures to neutralize special elements used in the operating system’s commands when processing the address parameter. Exploiting this...

The vulnerability of the Business Process Intelligence (BPI) module of the Nagios XI IT infrastructure monitoring tool allows a attacker to execute arbitrary commands.

The vulnerability of the Business Process Intelligence BPI module of the Nagios XI IT infrastructure monitoring tool is related to the failure to take measures to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute...

The vulnerability of the Docker Wizard tool for monitoring IT infrastructure Nagios XI allows a attacker to execute arbitrary commands.

The vulnerability of the Docker Wizard tool for monitoring IT infrastructure Nagios XI relates to the failure to take measures to neutralize certain elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

MAL-2025-191772 Malicious code in kdewebhelper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 da8701a407522875f63d2aaa28d27194fe8e2faa4d7782fd66639f224ae62dcd Importing the module connects to a Telegram bot and provides its operator with abilities to execute commands, exfiltrate and encrypt data. The target group see...