SilentSync RAT Delivered via Two Malicious PyPI Packages Targeting Python Developers

Cybersecurity researchers have discovered two new malicious packages in the Python Package Index PyPI repository that are designed to deliver a remote access trojan called SilentSync on Windows systems. "SilentSync is capable of remote command execution, file exfiltration, and screen capturing,"...

CVE-2023-49565

The cbismanager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without...

CVE-2023-49565

The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. The root cause is the improper sanitization of the X-FILENAME , X-PAGE , and X-FIELD HTTP headers, which are directly utilized within the subprocess.Popen Python function without adequate va...

CVE-2025-10634

A weakness has been identified in D-Link DIR-823X 240126/240802/250416. The impacted element is the function sub412E7C of the file /usr/sbin/goahead of the component Environment Variable Handler. This manipulation of the argument terminaladdr/serverip/serverport causes command injection. The atta...

CVE-2025-10629

A vulnerability was determined in D-Link DIR-852 1.00CN B09. This issue affects the function ssdpcgimain of the file htodcs/cgibin of the component Simple Service Discovery Protocol Service. Executing manipulation of the argument ST can lead to command injection. The attack may be performed from...

CVE-2025-10629

A vulnerability was determined in D-Link DIR-852 1.00CN B09. This issue affects the function ssdpcgimain of the file htodcs/cgibin of the component Simple Service Discovery Protocol Service. Executing manipulation of the argument ST can lead to command injection. The attack may be performed from...

CVE-2025-10628

A vulnerability was found in D-Link DIR-852 1.00CN B09. This vulnerability affects unknown code of the file /htdocs/cgibin/hedwig.cgi of the component Web Management Interface. Performing manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2025-10634

CVE-2025-10634 affects D-Link DIR-823X routers (versions 240126, 240802, 250416). The issue is in the Environment Variable Handler’s /usr/sbin/goahead component, specifically function sub_412E7C, where manipulating arguments terminal_addr/server_ip/server_port enables remote command injection. Th...

CVE-2025-10629

The CVE-2025-10629 affects D-Link DIR-852 (firmware 1.00CN B09) in the Simple Service Discovery Protocol Service, specifically the ssdpcgi_main function in htodcs/cgibin. The vulnerability arises from insufficient input filtering of the ST argument, enabling command injection and potential remote...

CVE-2025-10629 D-Link DIR-852 Simple Service Discovery Protocol Service cgibin ssdpcgi_main command injection

A vulnerability was determined in D-Link DIR-852 1.00CN B09. This issue affects the function ssdpcgimain of the file htodcs/cgibin of the component Simple Service Discovery Protocol Service. Executing manipulation of the argument ST can lead to command injection. The attack may be performed from...

CVE-2025-10629 D-Link DIR-852 Simple Service Discovery Protocol Service cgibin ssdpcgi_main command injection

A vulnerability was determined in D-Link DIR-852 1.00CN B09. This issue affects the function ssdpcgimain of the file htodcs/cgibin of the component Simple Service Discovery Protocol Service. Executing manipulation of the argument ST can lead to command injection. The attack may be performed from...

CVE-2025-10628

D-Link DIR-852 (1.00CN B09) Web Management Interface component /htdocs/cgibin/hedwig.cgi is affected by a command-injection vulnerability. The issue arises from insufficient input filtering in hedwig.cgi, enabling remote exploitation. Public exploits exist and the affected devices are noted as no...

CVE-2025-10628 D-Link DIR-852 Web Management hedwig.cgi command injection

A vulnerability was found in D-Link DIR-852 1.00CN B09. This vulnerability affects unknown code of the file /htdocs/cgibin/hedwig.cgi of the component Web Management Interface. Performing manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2023-49565: Improper Neutralization of Special Elements used in a Command

The cbismanager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without...

The vulnerability of the sub_410118() function in the microprogrammed software of TOTOLINK X6000R allows a hacker to execute arbitrary commands.

The vulnerability of the sub410118 function in the microprogrammed operating system of TOTOLINK X6000R relates to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the main() function in TOTOLINK EX1200T microcontroller-based routers allows a hacker to execute arbitrary commands.

The vulnerability of the main function in TOTOLINK EX1200T microcontroller-based routers lies in the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the sub_401340() function (/cgi-bin/login.cgi) of the WAVLINK WL-WN578W2 signal booster software allows a intruder to execute arbitrary commands.

The vulnerability of the sub401340 function /cgi-bin/login.cgi of the WAVLINK WL-WN578W2 signal booster software is related to the failure to take measures to neutralize special elements during the processing of the ipaddr parameter. Exploiting this vulnerability allows a remote attacker to execu...

The vulnerability of the sub_401C5C() function (firewall.cgi) of the WAVLINK WL-WN578W2 signal booster software allows a perpetrator to execute arbitrary commands.

The vulnerability of the sub401C5C function firewall.cgi in the WAVLINK WL-WN578W2 signal booster software is related to the failure to take measures to neutralize specific elements when processing parameters such as pingFrmWANFilterEnabled, blockSynFloodEnabled, blockPortScanEnabled, and...

The vulnerability of the sub_409184() function (/wizard_rep.shtml) of the WAVLINK WL-WN578W2 signal booster software allows a hacker to execute arbitrary commands.

The vulnerability of the sub409184 function /wizardrep.shtml of the WAVLINK WL-WN578W2 signal booster software is related to the failure to take measures to neutralize special elements during the processing of the selEncrypTyp parameter. Exploiting this vulnerability allows a remote attacker to...

The vulnerability of the sub_417D74() function in the microprogramming software for TOTOLINK X6000R allows a hacker to execute arbitrary commands.

The vulnerability of the sub417D74 function in the microprogrammed software of TOTOLINK X6000R routers is related to the lack of measures taken to clean data at the control level when processing the parameter filename. Exploiting this vulnerability allows a remote attacker to execute arbitrary...