CVE-2025-0422 Authenticated Remote Code Execution via ScriptVar

An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application. Remote Code Execution For this, the user must be able to create "ScriptVars" with the type „script" and preview them by, for example, creating a new "Info". By defaul...

SUSE CVE-2023-34049

The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script wi...

Seeds Acmailer和Seeds Acmailer Db 操作系统命令注入漏洞

Seeds Acmailer and Seeds Acmailer Db are both products of Seeds Corporation, Japan.Seeds Acmailer is a CGI software for supporting mail services.Seeds Acmailer Db is a CGI software for supporting mail services. This software will add Mysql database connectivity compared to the standard version,...

IBM UrbanCode Deploy和IBM DevOps Deploy 操作系统命令注入漏洞

IBM UrbanCode Deploy IBM UCD and IBM DevOps Deploy are both products of International Business Machines IBM, U.S.A. IBM UrbanCode Deploy is a suite of application automation deployment tools. The tool is based on an application deployment automation management information model, and through remot...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts

CVE-2024-53677 Exploitation Apache Struts RCE via File U...

SUSE CVE-2025-1244

A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect...

CVE-2025-1244

A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect...

AZL-56729 CVE-2025-1244 affecting package emacs for versions less than 29.4-2

A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect...

PT-2025-6868

Name of the Vulnerable Software and Affected Versions: Emacs affected versions not specified Description: A command injection flaw was found in the Emacs text editor, allowing a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. This can be achieved by...

CVE-2025-21376 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

...

Ruijie Networks RG-NBR2600S 安全漏洞

Ruijie Networks RG-NBR2600S is a gateway device from Ruijie Networks China. A security vulnerability exists in Ruijie Networks RG-NBR2600S version 10.34b12, which stems from a lack of length validation, and a buffer overflow vulnerability that could cause a remote target device to crash or execut...

PT-2025-6380 · H3C · H3C Fa3010L

Name of the Vulnerable Software and Affected Versions: H3C FA3010L access points version SWFA1B0V100R005 Description: A buffer overflow issue exists due to the lack of length verification, related to the setting of firewall rules. This can cause a remote target device to crash or execute arbitrar...

The vulnerability of Zyxel CPE series network device microprogramming software lies in the use of rigidly encrypted login credentials, which allows attackers to execute arbitrary codes.

The vulnerability of Zyxel network device software of the CPE series is related to the use of rigidly encrypted login credentials. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, using the default login credentials...

PT-2025-6262 · Fortinet · Fortiweb

Name of the Vulnerable Software and Affected Versions: Fortinet FortiWeb versions 7.4.0 through 7.6.0 Description: The issue is related to an improper neutralization of special elements used in an os command, also known as 'os command injection'. This allows an attacker to execute unauthorized co...

CVE-2025-1154

CVE-2025-1154 affects xxyopen Novel up to 3.4.1. The /api/front/search/books endpoint is vulnerable due to manipulation of the sort parameter, which leads to SQL injection. The issue can be exploited remotely and the exploit has been disclosed publicly. Multiple sources (Red Hat, NVD/CVE listings...

Azure Linux 3.0 Security Update: mariadb (CVE-2024-0901)

The version of mariadb installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-0901 advisory. - Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of...

CVE-2025-1077

A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products NAMIS, Aero Weather, Satellite Weather. The vulnerability is present in the Product Delivery Service PDS component in specific server configurations where the PDS pipeline utilizes the...

VulnCheck KEV: CVE-2011-2688

SQL injection vulnerability in mysql/mysql-auth.pl in the modauthnzexternal module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field...

CVE-2022-43542

Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete...

CVE-2022-23597

Element Desktop is a Matrix client for desktop platforms with Element Web at its core. Element Desktop before 1.9.7 is vulnerable to a remote program execution bug with user interaction. The exploit is non-trivial and requires clicking on a malicious link, followed by another button click. To the...