The vulnerability of the sub_4C0990 function in D-Link DI-7100G router’s microprogramming system allows a hacker to execute arbitrary commands.

The vulnerability of the sub4C0990 function in D-Link DI-7100G router microprogramming software is related to the execution of operations outside the buffer in memory when processing the openid parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2025-41990

Name of the Vulnerable Software and Affected Versions network access point configuration services affected versions not specified Description A flaw exists in the web-based management interface of network access point configuration services that could allow a remote attacker with authentication t...

The vulnerability of the ping6() function in D-Link DSL-7740C router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the ping6 function in the microprogramming software of the D-Link DSL-7740C router is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

The vulnerability of the sub_4BD4F8() function in the /webchat/hi_block.asp file of the D-Link DI-7100G router’s software allows a hacker to execute arbitrary commands.

The vulnerability of the sub4BD4F8 function in the /webchat/hiblock.asp file of the D-Link DI-7100G router’s software lies in the fact that the operation results are written outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-11665

A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdatermain of the file rgbin of the component Firmware Update Handler. Performing manipulation results in os command injection. The attack may be initiated remotely. This vulnerability only affects products th...

CVE-2025-11665

A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdatermain of the file rgbin of the component Firmware Update Handler. Performing manipulation results in os command injection. The attack may be initiated remotely. This vulnerability only affects products th...

CVE-2025-11665 D-Link DAP-2695 Firmware Update rgbin fwupdater_main os command injection

A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdatermain of the file rgbin of the component Firmware Update Handler. Performing manipulation results in os command injection. The attack may be initiated remotely. This vulnerability only affects products th...

CVE-2025-11665 D-Link DAP-2695 Firmware Update rgbin fwupdater_main os command injection

A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdatermain of the file rgbin of the component Firmware Update Handler. Performing manipulation results in os command injection. The attack may be initiated remotely. This vulnerability only affects products th...

CVE-2025-11665

The CVE-2025-11665 issue affects D-Link DAP-2695 (firmware version 2.00RC131). The root cause is in the fwupdater_main function of the rgbin component within the Firmware Update Handler, where input handling allows os command injection. The vulnerability can be triggered remotely and may lead to ...

The vulnerability of the HNAP1 protocol implementation in D-Link DIR-852 microprogrammed router software allows a hacker to execute arbitrary commands.

The vulnerability of the HNAP1 protocol implementation in D-Link DIR-852 microprogrammed router software is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-30001

Apache StreamPark, a streaming media application development framework, is vulnerable to an Incorrect Execution-Assigned Permissions issue in versions 2.1.4 through 2.1.5 . This vulnerability allows authenticated users to trigger remote command execution , which could lead to compromised confiden...

CVE-2025-11523

A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used...

EUVD-2025-33371

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Quick Template page that, when visited by another user, enables the attacker to execute commands with the target's...

CVE-2025-10283

BBOT’s gitdumper module is vulnerable due to insufficient sanitization of .git data, enabling Directory Traversal that can lead to Remote Code Execution when processing a malicious git repository. Affected component: bb ot gitdumper.py (processing of .git/config and related index/file handling as...

EUVD-2025-33343

scio is vunerable to Remote Command Execution through PyTorch...

GHSA-M9MP-6X32-5RHG scio is vunerable to Remote Command Execution through PyTorch

Impact PyTorch reported a critical vulnerability when using torch.load, even with option weightsonly=True, for torch = 2.6, starting from scio = 1.0.1 currently in dev state. Workarounds You can manually check that you are using torch = 2.6...

CVE-2025-11523

A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used...

CVE-2025-11523

A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used...

EUVD-2025-33259

A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used...

CVE-2025-53967

Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl command. The vulnerable endpoint fails to properly sanitize...