EUVD-2025-180081

Malicious code in big-data-shell-omega-reject npm...

EUVD-2025-176405

Malicious code in shell-integer-optimize-log-promise npm...

EUVD-2025-176404

Malicious code in shell-omicron-dog-bash-simple npm...

EUVD-2025-179160

Malicious code in emulate-link-shell-async-double npm...

EUVD-2025-176470

Malicious code in sed-shell-cat-encrypt-parse npm...

CVE-2025-60701

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1FW102B02 within the prog.cgi and rc binaries. The sub433188 function in prog.cgi stores user-supplied email configuration parameters EmailFrom, EmailTo, SMTPServerAddress, SMTPServerPort, AccountName in NVRAM v...

CVE-2025-60701

A command injection vulnerability exists in the D-Link DIR-882 Router firmware version DIR882A1_FW102B02 within the prog.cgi and rc binaries. The vulnerability occurs because the sub_433188 function in prog.cgi stores user-supplied email configuration parameters (such as EmailFrom and AccountName...

Supermicro BMC 安全漏洞

The SuperMicro BMC is a firmware from SuperMicro USA used in devices such as servers, top-of-rack switches or RAID devices. A security vulnerability exists in Supermicro BMC that stems from a stack-based buffer overflow in the Insyde SMASH shell program...

PT-2025-46795

Name of the Vulnerable Software and Affected Versions Supermicro BMC Insyde SMASH affected versions not specified Description The Insyde SMASH shell program within Supermicro BMC contains a stacked-based overflow issue. This flaw could allow for remote code execution. Recommendations At the momen...

Siemens SIMATIC S7-1500 Improper Input Validation (CVE-2023-27538)

libcurl would reuse a previously created connection even when an SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, two SSH settings were...

Siemens SIMATIC S7-1500 Improper Neutralization of Special Elements used in a Command (CVE-2014-7209)

run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

CVE-2025-60682

The ToToLink A720R Router (firmware V4.1.5cu.614_B20230630 ) contains a command injection vulnerability in the cloudupdate_check binary. Specifically, the sub_402414 function fails to sanitize or escape user-supplied 'magicid' and 'url' values, which are directly concatenated into shell commands ...

CVE-2025-7704: Stack-based Buffer Overflow

Supermicro BMC Insyde SMASH shell program has a stacked-based overflow vulnerability...

CVE-2025-60698

A command injection vulnerability exists in the D-Link DIR-882 Router firmware version DIR882A1_FW102B02 . The issue stems from the sub_432F60 function in the prog.cgi binary, which stores user-supplied SetSysLogSettings/IPAddress values in NVRAM via nvram_safe_set. These values are subsequently ...

CVE-2025-12763: Improper Neutralization of Special Elements used in an OS Command

pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input...

CVE-2025-60682

A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614B20230630 within the cloudupdatecheck binary, specifically in the sub402414 function that handles cloud update parameters. User-supplied 'magicid' and 'url' values are directly concatenated into shell...

CVE-2025-60676

An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed...

pgAdmin 安全漏洞

pgAdmin is pgAdmin open source an open source management and development platform for the open source database PostgreSQL. A security vulnerability exists in pgAdmin 4 9.9 and earlier versions, which stems from the use of shell=True for backup and restore operations on Windows systems, which coul...

Siemens SIMATIC S7-1500 Improper Neutralization of Special Elements used in a Command (CVE-2015-20107)

In Python aka CPython up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input if they lack validation of user-provided...

Ilevia EVE X1/X5 Server 4.7.18.0.eden Authenticated Remote Command Injections

Summary EVE is a smart home and building automation solution designed for both residential and commercial environments, including malls, hotels, restaurants, bars, gyms, spas, boardrooms, and offices. It enables comprehensive control and monitoring of electrical installations through a highly...