The vulnerability of the microprogrammed software of the Zenitel TCIV-3+ IP video door phones lies in the lack of measures to neutralize the special elements used in the operating system’s commands, allowing intruders to execute arbitrary commands.

The vulnerability of the microprogrammed software of the Zenitel TCIV-3+ IP video door phones is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

📄 Cisco ISE API 3.0 Command Injection

Proof of concept exploit for a command injection vulnerability in Cisco ISE API version 3.0. ============================================================================================================================================= | Title : Cisco ISE API 3.0 command injection Exploits | |...

EUVD-2025-199764

TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP parameters "command", "todo", and "nextfile," which allows an attacker to execute arbitrary commands with root privileges...

CVE-2025-64127 Zenitel TCIV-3+ OS Command Injection

An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to execute arbitrary commands remotely...

Remote Command Execution

scio-pypi is vulnerable to Remote Command Execution. The vulnerability is due to torch.load executing unsafe deserialization even when weightsonly=True, which allows an attacker to craft malicious model files that trigger arbitrary code execution during loading...

Remote Command Execution

n8n and n8n-nodes-base are vulnerable to Remote Command Execution. The vulnerability is due to the Execute Command node allowing arbitrary command execution on the host system, which allows an attacker to exploit insufficient user trust controls to run malicious commands leading to system...

CVE-2025-65202

TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP parameters "command", "todo", and "nextfile," which allows an attacker to execute arbitrary commands with root privileges...

CVE-2025-65202

The TRENDnet TEW-657BRM WiFi router (version 1.00.1 ) is vulnerable to an authenticated remote OS command injection vulnerability in the setup.cgi binary. The flaw is caused by improper neutralization of special elements, allowing an attacker to exploit the HTTP parameters "command" , "todo" , an...

TRENDnet TEW-657BRM 安全漏洞

The TRENDnet TEW-657BRM is a WiFi router from TRENDnet. The TRENDnet TEW-657BRM suffers from a command injection vulnerability that is caused by a flaw in the setup.cgi binary file. An attacker can exploit this vulnerability to execute arbitrary operating system commands on the system...

The vulnerability of the SetDMZSettings() function in the prog.cgi script of the D-link DIR-878A1 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the SetDMZSettings function in the prog.cgi script of the D-link DIR-878A1 router microprogramming system is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

The vulnerability of the SetNetworkSettings() function in the prog.cgi script of the D-link DIR-878A1 router’s software allows a hacker to execute arbitrary commands.

The vulnerability of the SetNetworkSettings function in the prog.cgi script of the D-link DIR-878A1 router’s microprogramming system is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary comman...

CVE-2025-64127: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to execute arbitrary commands remotely...

The vulnerability of the NIM server for the IBM AIX and IBM VIOS operating systems allows attackers to execute arbitrary commands.

The vulnerability of the NIM server for the IBM AIX and IBM VIOS operating systems is related to improper process management. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

VulnCheck KEV: CVE-2024-10915

A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgiuseradd of the file /cgi-bin/accountmgr.cgi?cmd=cgiuseradd. The manipulation of the argument group leads to os command injection. T...

CLSA-2025-1764080949 pcp: Fix of CVE-2024-3019

CVE-2024-3019: Fix default pmproxy configuration to restrict access to Redis server backend, preventing remote command execution...

The vulnerability of the operating system for end devices based on Linux IGEL OS, related to the failure to take measures to neutralize special elements used in the operating system’s commands, allows a perpetrator to execute arbitrary commands.

The vulnerability of the Linux-based IGEL OS for end devices is related to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the `saveParentControlInfo` function in the Tenda AC23 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the saveParentControlInfo function in the Tenda AC23 router’s microprogramming software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

The vulnerability of Instantel Micromate software lies in the lack of authentication for a critical function, allowing attackers to execute arbitrary commands.

The vulnerability of Instantel Micromate software is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the microprogrammed software of the GL.iNet MT6000, A1300, X300B, AX1800, AXT1800, MT2500, MT3000, X3000, XE3000, XE300, E750, X750, SFT1200, AR300M, AR300M16, AR750, AR750S, B1300, MT1300, MT300N-V2, AP1300, B2200, MV1000, MV1000W, USB150, SF1200, N300, S1300 lies in the incorrect limitation on the path name to the restricted access directory. This allows attackers to execute arbitrary commands.

The vulnerability of the microprogrammed software of the GL.iNet MT6000, A1300, X300B, AX1800, AXT1800, MT2500, MT3000, X3000, XE3000, XE300, E750, X750, SFT1200, AR300M, AR300M16, AR750, AR750S, B1300, MT1300, MT300N-V2, AP1300, B2200, MV1000, MV1000W, USB150, SF1200, N300, S1300 lies in the...

The vulnerability of the CookieHandler component in D-Link’s DSP-W110A1 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the CookieHandler component in D-Link’s DSP-W110A1 router microprogramming software is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...