OS Command Injection

Ray is vulnerable to Os command Injection. The vulnerability is due to improper input sanitization in the cpuprofile URL parameter, allowing attackers to execute OS commands remotely on the system running the Ray dashboard without authentication...

The vulnerability in Microsoft Word, Microsoft Office suites, and Microsoft 365 Apps for Enterprise allows a perpetrator to execute arbitrary code.

The vulnerability of Microsoft Word, the Microsoft Office suite, and Microsoft 365 Apps for Enterprise is related to the use of an untrusted pointer. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the Active Directory Federation Server component for the Windows operating system, which allows a attacker to perform a CSRF attack

The vulnerability of the Active Directory Federation Server operating system on Windows is related to the manipulation of cross-site requests. Exploiting this vulnerability can allow a malicious actor to execute a CSRF attack remotely...

PT-2025-1256

Name of the Vulnerable Software and Affected Versions SonicWall SMA 1000 Series versions prior to 12.4.3-02854 Description A critical pre-authentication deserialization of untrusted data vulnerability exists in the SMA1000 Appliance Management Console AMC and Central Management Console CMC...

The vulnerability of the graphical interface of the FortiSandbox system allows a perpetrator to execute arbitrary commands.

The vulnerability of the FortiSandbox threat detection and mitigation graphical interface exists due to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using specially created requests...

The vulnerability of the QuTS operating systems and QTS network devices from Qnap, related to the failure to eliminate CRLF sequences, allows attackers to execute arbitrary code.

The vulnerability of the QuTS operating systems and QTS network devices involves a lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

The vulnerability of the QuTS operating systems and QTS network devices from Qnap, related to the failure to eliminate CRLF sequences, allows attackers to execute arbitrary code.

The vulnerability of the QuTS operating systems and QTS network devices involves a lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

MAL-2025-141 Malicious code in serve-static-corell (npm)

This package includes a post-install script that fetches JavaScript code from a remote server and executes it. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fdac054c93284fd4c0dca285d57baabea075f4c42f7a8bd63abf69f974d56b31 Any computer that has this package install...

Craft CMS 代码注入漏洞

Craft CMS is a content management system CMS open source by Craft CMS. A code injection vulnerability exists in Craft CMS versions 5.0.0-RC1 through prior to 5.5.5 and 4.0.0-RC1 through prior to 4.13.8, which stems from the presence of a security key disclosure, resulting in vulnerability to remo...

VulnCheck KEV: CVE-2025-23209

Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution...

CVE-2024-57784

CVE-2024-57784 targets Zenitel AlphaWeb XE v11.2.3.10, in the component /php/script_uploads.php, enabling a directory traversal. The issue is documented across multiple feeds as an arbitrary file read vulnerability within the web service’s script_uploads.php path. Public exploit activity exists (...

CVE-2025-0356

The CVE-2025-0356 entry concerns NEC Corporation Aterm WX1500HP (version up to 1.4.2) and WX3600HP (version up to 1.5.3). Reported issue: an attacker could execute arbitrary OS commands over the network, i.e., an OS command injection affecting the affected devices. The vulnerability is observed i...

The vulnerability of the Opigno CMS system’s module, related to errors in processing input data during syntax analysis of code, allows attackers to execute arbitrary code.

The vulnerability of the Opigno CMS system’s module is related to errors in data processing during syntax analysis of the code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Windows operating system’s Telephony Service allows a perpetrator to execute arbitrary code.

The vulnerability of the Windows operating system’s Telephony Service is related to overflowing buffers in the dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-13162

SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-32848...

CVE-2025-21291

CVE-2025-21291 is a Windows Direct Show remote code execution vulnerability. Documented CVSSv3.1 shows high risk (8.8) with network exploitation requiring user interaction. Affected: Windows DirectShow components; root cause specifics not disclosed in provided materials. Microsoft has released se...

CVE-2025-21171 .NET Remote Code Execution Vulnerability

...

Ivanti CVE-2025-0282 Checker

This script allows you to safely scan and test to see if you are vulnerable to CVE-2025-0282, a stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 that allows a...

CVE-2024-57471

CVE-2024-57471 affects H3C N12 V100R005. The issue is a buffer overflow caused by lack of length verification in the 2.4G wireless network processing function, allowing a remote attacker to crash the device or run arbitrary commands by sending a POST request to /bin/webs. Documents consistently i...

Wavlink AC3000 adm.cgi set_TR069() command injection vulnerability

Talos Vulnerability Report TALOS-2024-2028 Wavlink AC3000 adm.cgi setTR069 command injection vulnerability January 14, 2025 CVE Number CVE-2024-21797 SUMMARY A command execution vulnerability exists in the adm.cgi setTR069 functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HT...