WAVLINK WL-NU516U1 安全漏洞

WAVLINK WL-NU516U1 is a wireless print server from China Ruiyin WAVLINK. A security vulnerability exists in the Wavlink WL-NU516U1 version 240425, which originates from the incorrect operation of the parameter ipaddr in the file /cgi-bin/login.cgi, which could lead to a remote os command injectio...

PT-2025-38672

Name of the Vulnerable Software and Affected Versions Ruijie 6000-E10 versions through 2.4.3.6-20171117 Description A weakness exists in Ruijie 6000-E10. The issue affects an unknown part of the file /view/vpn/autovpn/sub commit.php. Manipulation of the key argument can lead to operating system...

PT-2026-3235

Apache bRPC and Affected Versions Apache bRPC versions prior to 1.15.0 Description Apache bRPC contains a remote command injection flaw in the heap profiler built-in service. The /pprof/heap endpoint does not properly validate the extra options parameter, allowing attackers to execute arbitrary...

PT-2025-38673

Name of the Vulnerable Software and Affected Versions: Wavlink WL-NU516U1 version 240425 Description: A security issue has been identified in the sub 4012A0 function of the /cgi-bin/login.cgi file. Manipulation of the ipaddr argument can lead to operating system command injection. This attack is...

The vulnerability of the ping() function in D-Link DSL-7740C router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the ping function in D-Link DSL-7740C router microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

The vulnerability of the jhttpd component of the D-Link DI-500WF router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the jhttpd component in the D-Link DI-500WF router microprogramming system is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the sub_433F7C() function (version_upgrade.asp) in the jhttpd component of the D-Link DI-8100G, DI-8200G, and DI-8003G routers allows a hacker to execute arbitrary commands.

The vulnerability of the sub433F7C function versionupgrade.asp in the jhttpd component of D-Link router modules DI-8100G, DI-8200G, and DI-8003G lies in the lack of measures to neutralize special elements used in operating systems when processing the path parameter. Exploiting this vulnerability...

The vulnerability of the backup function of the D-Link DSL7740C router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the backup function of the D-Link DSL7740C router’s microprogramming system is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the traceroute6 function in the microprogramming-based router D-Link DSL7740C allows a hacker to execute arbitrary commands.

The vulnerability of the traceroute6 function in the microprogramming-based router D-Link DSL7740C is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-10689

A vulnerability was identified in D-Link DIR-645 105B01. This issue affects the function soapcgimain of the file /soap.cgi. Such manipulation of the argument service leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. This...

CVE-2023-49565

The cbismanager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without...

📄 aaPanel 7.x.x Remote Command Execution

aaPanel version 7.x.x suffers from an authenticated remote command execution vulnerability. This was discovered prior and noted in CVE-2020-14421 where it states that it affects versions 6.6.6 and below. The developers claim it is patched but it still affects the 7.x.x version. This is...

Vulnerability of the runtime.ddnsStatus() function in Linksys E5600 router microprogramming software, allowing a hacker to execute arbitrary commands

The vulnerability of the runtime.ddnsStatus function in Linksys E5600 router microprogramming software is related to the lack of measures taken to neutralize special elements used in the operating system’s command for processing the username parameter. Exploiting this vulnerability allows a remot...

Vulnerability of the runtime.ddnsStatus() function in Linksys E5600 router microprogramming software, allowing a hacker to execute arbitrary commands

The vulnerability of the runtime.ddnsStatus function in Linksys E5600 router microprogramming software is related to the lack of measures taken to neutralize special elements used in the operating system’s processing of the hostname parameter. Exploiting this vulnerability allows a remote attacke...

Vulnerability of the runtime.ddnsStatus() function in Linksys E5600 router microprogramming software, allowing a hacker to execute arbitrary commands

The vulnerability of the runtime.ddnsStatus function in Linksys E5600 router microprogramming software is related to the lack of measures taken to neutralize special elements used in the operating system’s command for processing the password parameter. Exploiting this vulnerability allows a remot...

Vulnerability of the runtime.ddnsStatus() function in Linksys E5600 router microprogramming software, allowing a hacker to execute arbitrary commands

The vulnerability of the runtime.ddnsStatus function in Linksys E5600 router microprogramming software is related to the failure to eliminate special elements used in the operating system’s command for processing the mailex parameter. Exploiting this vulnerability allows a remote attacker to...

The vulnerability of the diag_ping_start() function in Linksys E3000 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the diagpingstart function in Linksys E3000 router microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

The vulnerability in the `apply.cgi` script of the Linksys WRT160Nv2 router microprogramming system allows a hacker to execute arbitrary commands.

The vulnerability in the apply.cgi script of the Linksys WRT160Nv2 router microprogramming system is related to the improper elimination of certain elements used in the operating system’s command for processing the pingsize parameter. Exploiting this vulnerability allows an attacker to execute...

CVE-2025-10689

The CVE-2025-10689 entry concerns D-Link DIR-645 firmware (model 105B01). A vulnerability exists in the soapcgi_main function within /soap.cgi where manipulation of the service argument enables remote command injection. The issue can be exploited remotely and publicly available exploit code is no...

CVE-2025-10689 D-Link DIR-645 soap.cgi soapcgi_main command injection

A vulnerability was identified in D-Link DIR-645 105B01. This issue affects the function soapcgimain of the file /soap.cgi. Such manipulation of the argument service leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. This...