MiracleLinux 7 : emacs-24.3-20.el7 (AXSA:2017-2282:02)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-2282:02 advisory. A command injection flaw within the Emacs enriched mode handling has been discovered. By tricking an unsuspecting user into opening a specially crafted file...

The vulnerability of the msp_info_htm() function in the msp_info.htm file of the D-Link DI-7400G+ router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the mspinfohtm function in the mspinfo.htm file of the D-Link DI-7400G+ router microprogramming system is related to the lack of measures taken to neutralize special elements during the processing of the cmd parameter. Exploiting this vulnerability allows a remote attacker to...

CVE-2026-23523: Improper Control of Generation of Code

Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user confirmation and can lead to arbitrary local command execution on the...

CVE-2025-60021: Improper Neutralization of Special Elements used in a Command

Remote command injection vulnerability in heap profiler builtin service in Apache bRPC all versions 1.15.0 on all platforms allows attacker to inject remote command. Root Cause: The bRPC heap profiler built-in service /pprof/heap does not validate the user-provided extraoptions parameter and...

CVE-2021-47758

Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module upload functionality. Authenticated attackers can generate and upload a ZIP plugin with a PHP backdoor that enables...

PT-2026-3034

Name of the Vulnerable Software and Affected Versions Chikitsa Patient Management System version 2.0.2 Description The software contains an authenticated remote code execution issue. Attackers can upload malicious PHP plugins through the module upload functionality. Authenticated attackers can...

PT-2026-5234

Name of the Vulnerable Software and Affected Versions Totolink A7000R version 4.1cu.4154 Description A flaw exists in Totolink A7000R version 4.1cu.4154 that allows for command injection. The issue is located in the CloudACMunualUpdateUserdata function within the /cgi-bin/cstecgi.cgi file...

Linux Distros Unpatched Vulnerability : CVE-2023-54335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers...

CVE-2022-50806

4images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse shell code through template editing functionality. Attackers can save malicious code in the template and execute arbitrary commands by accessing a specific categories.php...

VMware Spring CLI VSCode Extension 安全漏洞

VMware Spring CLI VSCode Extension is a Visual Studio Code add-in from VMware, Inc. A security vulnerability exists in VMware Spring CLI VSCode Extension that originates from command injection and could lead to the execution of commands on a user's machine...

MiracleLinux 3 : logwatch-7.3-9.AXS3 (AXSA:2011-82:01)

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2011-82:01 advisory. Logwatch is a customizable, pluggable log-monitoring system. It will go through your logs for a given period of time and make a report in the areas that you wi...

The vulnerability of the HTTP Handler component of the /goform/set_blacklist file in the microprogramming-based routing software LB-LINK allows a attacker to execute arbitrary commands.

The vulnerability of the HTTP Handler component in the /goform/setblacklist file of the LB-LINK router microsystem is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the HTTP Handler component of the /goform/set_hidessid_cfg file in the microprogramming-based routing software for LB-LINK allows a attacker to execute arbitrary commands.

The vulnerability of the HTTP Handler component in the /goform/sethidessidcfg file of the LB-LINK router microprogramming system is related to the lack of data cleaning at the management level when processing the enable parameter. Exploiting this vulnerability allows a remote attacker to execute...

MiracleLinux 4 : bind-9.7.3-2.2.0.1.AXS4.P3 (AXSA:2011-406:01)

"The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-406:01 advisory. BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves ho...

MiracleLinux 4 : xorg-x11-server-utils-7.4-15.AXS4.1 (AXSA:2011-155:01)

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2011-155:01 advisory. A collection of utilities used to tweak and query the runtime configuration of the X server Security issues fixed with this release; CVE-2011-0465 xrdb.c in...

Fortinet FortiSIEM Unauthenticated Remote Command Injection (FG-IR-25-772)

The version of Fortinet FortiSIEM running on the remote server is 6.7.x through 6.7.10, 7.0.x through 7.0.4, 7.1.x prior to 7.1.9, 7.2.x prior to 7.2.7, 7.3.x prior to 7.3.5, or 7.4.0. It is, therefore, affected by an unauthenticated remote command injection vulnerability: - An improper...

CVE-2023-54339

Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index.php. Attackers can execute arbitrary system commands by manipulating the dataFile parameter, such as using payload '0%27%26calc.exe%26%27'...

CVE-2023-54335

eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers can exploit this flaw to upload malicious PHP files and execute remote commands on the vulnerable file management system...

CVE-2023-54335

eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers can exploit this flaw to upload malicious PHP files and execute remote commands on the vulnerable file management system...

UBUNTU-CVE-2023-54335

eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers can exploit this flaw to upload malicious PHP files and execute remote commands on the vulnerable file management system...