CVE-2025-57799

CVE-2025-57799 relates to StreamVault, a multi-platform video parsing/downloading tool. Affects versions prior to 250822 where an attacker can modify system parameters, craft and execute commands, enabling remote command execution and potential server privilege gain. Patch released in 250822. In ...

CVE-2025-57799 StreamVault can perform remote command execution

StreamVault is a multi-platform video parsing and downloading tool. Prior to version 250822, after logging into the StreamVault-system, an attacker can modify certain system parameters, construct malicious commands, execute command injection attacks against the system, and ultimately gain server...

CVE-2025-57799

StreamVault is a multi-platform video parsing and downloading tool. Prior to version 250822, after logging into the StreamVault-system, an attacker can modify certain system parameters, construct malicious commands, execute command injection attacks against the system, and ultimately gain server...

CVE-2009-20010

Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php script used by its mail subsystem. The vulnerability arises from unsanitized user input passed via a POST request to the data parameter, which is processed by the underlying shell without adequate...

CVE-2025-54857

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in SkyBridge BASIC MB-A130 Ver.1.5.8 and earlier. If exploited, a remote unauthenticated attacker may execute arbitrary OS commands with root privileges...

CVE-2025-9752

A security vulnerability has been detected in D-Link DIR-852 1.00CN B09. Impacted is the function soapcgimain of the file soap.cgi of the component SOAP Service. Such manipulation of the argument service leads to os command injection. The attack can be launched remotely. The exploit has been...

CVE-2025-57799: Improper Neutralization of Special Elements used in an OS Command

StreamVault is a multi-platform video parsing and downloading tool. Prior to version 250822, after logging into the StreamVault-system, an attacker can modify certain system parameters, construct malicious commands, execute command injection attacks against the system, and ultimately gain server...

The vulnerability of the setRebootScheCfg() function (/cgi-bin/cstecgi.cgi) in the TOTOlink EX1800T Wi-Fi extension software allows a intruder to execute arbitrary commands.

The vulnerability of the setRebootScheCfg function /cgi-bin/cstecgi.cgi of the TOTOlink EX1800T Wi-Fi extension software is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability could allow a remote attacker to...

The vulnerability of the `setUpgradeUboot()` function (upgrade.so) in the TOTOLINK CA300-PoE router’s microprogramming software allows a attacker to execute arbitrary commands.

The vulnerability of the setUpgradeUboot function in the upgrade.so library of TOTOLINK CA300-PoE router microprogramming software is related to the failure to take measures to clean data at the management level when processing the FileName parameter. Exploiting this vulnerability can allow an...

The vulnerability of the Splunk Enterprise platform for operational analysis lies in its lack of measures to neutralize special elements used in the operating system’s command set, allowing attackers to execute arbitrary commands.

The vulnerability of the Splunk Enterprise platform for operational analysis is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

PT-2025-35457

Name of the Vulnerable Software and Affected Versions SkyBridge BASIC MB-A130 versions prior to 1.5.8 Description Improper neutralization of special elements used in an OS command 'OS Command Injection' exists in the software. If exploited, a remote unauthenticated attacker may execute arbitrary ...

The vulnerability of the QuickSetting() function (ap.so) in the TOTOLINK CA300-PoE router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the QuickSetting function ap.so in the TOTOLINK CA300-PoE router’s microprogramming system is related to the lack of measures taken to clean data at the control level when processing the hour/minute parameter. Exploiting this vulnerability could allow a remote attacker to...

The vulnerability of the setDmzCfg() function (/cgi-bin/cstecgi.cgi) in the TOTOlink EX1800T Wi-Fi extension software allows a intruder to execute arbitrary commands.

The vulnerability of the setDmzCfg function /cgi-bin/cstecgi.cgi of the TOTOlink EX1800T Wi-Fi extension software is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability could allow a remote attacker to execu...

CVE-2025-9745

A security vulnerability has been detected in D-Link DI-500WF 14.04.10A1T. The impacted element is an unknown function of the file /versionupgrade.asp of the component jhttpd. The manipulation of the argument path leads to os command injection. The attack may be initiated remotely. The exploit ha...

CVE-2025-30264

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145...

CVE-2025-9654

A security flaw has been discovered in AiondaDotCom mcp-ssh up to 1.0.3. Affected by this issue is some unknown functionality of the file server-simple.mjs. Performing manipulation results in command injection. The attack can be initiated remotely. Upgrading to version 1.0.4 and 1.1.0 can resolve...

CVE-2025-9727

A weakness has been identified in D-Link DIR-816L 206b01. Affected by this issue is the function soapcgimain of the file /soap.cgi. This manipulation of the argument service causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the publ...

CVE-2025-9727

A weakness has been identified in D-Link DIR-816L 206b01. Affected by this issue is the function soapcgimain of the file /soap.cgi. This manipulation of the argument service causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the publ...

CVE-2025-9603

A vulnerability was determined in Telesquare TLR-2005KSH 1.2.4. The affected element is an unknown function of the file /cgi-bin/internet.cgi?Command=lanCfg. Executing manipulation of the argument Hostname can lead to command injection. The attack may be performed from a remote location. The...

CVE-2025-9580

A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/setblacklist of the component HTTP Handler. Such manipulation of the argument mac leads to os command injection. The attack can be launched remotely. The exploit has been...