933 matches found
CVE-2025-65363: Improper Neutralization of Special Elements used in a Command
Authenticated append-style command-injection Ruijie APs APRGOS 11.1.x allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the webaction.do endpoint...
CVE-2018-25126: Use of Hard-coded Credentials
Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware used by many white-labeled DVR/NVR/IPC products contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor...
CVE-2025-63296
KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: during startup /usr/sbin/anykaservice.sh scans mounted TF/SD cards and, if /mnt/update.nor.sh is present, copies it to /tmp/net.sh and executes it as root...
CVE-2025-63296: Improper Neutralization of Special Elements used in a Command
KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: during startup /usr/sbin/anykaservice.sh scans mounted TF/SD cards and, if /mnt/update.nor.sh is present, copies it to /tmp/net.sh and executes it as root...
PT-2025-45161
Name of the Vulnerable Software and Affected Versions PocketVJ CP versions 3.9.1 Description The application does not properly sanitize user input in the opacityValue POST parameter before it is used in a shell command. This allows remote attackers to execute arbitrary commands with root privileg...
PocketVJ CP 安全漏洞
PocketVJ CP is a control panel software by magdesign individual developers. A security vulnerability exists in PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1, which stems from the submitopacity.php component failing to clean up user input for the capacityValue POST parameter, which could allow a...
CVE-2025-34274
Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin, pipeline configuration...
CVE-2018-25120: Improper Neutralization of Special Elements used in an OS Command
D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05 contain a command injection vulnerability in the Mail Test functionality. The web maintenance script posts to the internal goForm endpoint '/goform/MailTest' and uses several form parameters directly in a call t...
EUVD-2019-6020
Malware in sbrugna...
EUVD-2018-13041
Malware in sbrugna...
EUVD-2021-13508
Malware in sbrugna...
EUVD-2018-18285
Malware in sbrugna...
EUVD-2002-1530
Malware in sbrugna...
EUVD-2018-20679
Malware in sbrugna...
EUVD-2018-8935
Malware in sbrugna...
EUVD-2018-3039
Malware in sbrugna...
EUVD-2018-6810
Malware in sbrugna...
EUVD-2011-3562
Malware in sbrugna...