4144 matches found
CVE-2025-14731
CVE-2025-14731 affects CTCMS Content Management System up to version 2.1.2. The issue resides in the Frontend/Template Management Module, specifically the library file /ctcms/apps/libraries/CT_Parser.php, where improper neutralization of special elements used in the template engine is reported. T...
CVE-2025-12504
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Talent Software UNIS allows SQL Injection. This issue affects UNIS: before 42321...
PT-2025-49895
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows SQL Injection.This issue affects Ninja Tables: from n/a through = 5.2.3...
PT-2025-50150
Name of the Vulnerable Software and Affected Versions Microsoft Windows PowerShell versions prior to December 17, 2025 Description The issue is a command injection flaw in Windows PowerShell that allows an unauthorized attacker to execute code locally. The flaw stems from improper neutralization ...
PCIe Specification Issues
Summary PCIe SIG in industry coordination with CERT CC is releasing details on three PCIe specification issues...
PT-2026-2520
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel had an issue where inotify and fanotify allowed users without read access to a file to subscribe to events on its children when they had access to the parent directory...
Unauthenticated RCE in React Server Components (React2Shell)
A critical unauthenticated Remote Code Execution RCE vulnerability exists in React Server Components RSC Flight protocol. The vulnerability allows attackers to achieve prototype pollution during deserialization of RSC payloads by sending specially crafted multipart requests with "proto",...
Advisory ROSA-SA-2025-3080
Software: aide 0.15.1 OS: rosa-server79 unaffected versions = aide-0.15.1-13.0.3.res7.1 affected versions aide-0.15.1-13.0.3.res7.1 CVE-ID: CVE-2025-54389 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: Vulnerability in AIDE before version 0.19.2: Special characters in filenames and symbolic links are...
Werkzeug safe_join() allows Windows special device names
Werkzeug's safejoin function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. sendfromdirectory uses safejoin to safely serve files at user-specified paths under a director...
EUVD-2025-199728
Improper neutralization of special elements used in an OS command 'command injection' in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution...
The vulnerability of the pgAdmin 4 database management tool lies in its failure to eliminate special elements in LDAP requests, allowing attackers to trigger a service failure.
The vulnerability of the pgAdmin 4 database management tool is related to the lack of measures taken to neutralize special elements in LDAP requests. Exploiting this vulnerability allows a malicious actor to cause service failures by entering special LDAP symbols in the username...
CVE-2025-55055
CWE-78 Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...
CVE-2025-55055
CWE-78 Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...
CVE-2025-55055
CWE-78 Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...
HSEC-2023-0011 git-annex GPG decryption attack via compromised remote
git-annex GPG decryption attack via compromised remote A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's GPG key. This attack could be used to expose encrypted data that was never stored in git-annex. Daniel Dent discovered this...
HSEC-2023-0010 git-annex private data exfiltration to compromised remote
git-annex private data exfiltration to compromised remote Some uses of git-annex were vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN. Joey He...
Sony NCP-HG100 操作系统命令注入漏洞
The Sony NCP-HG100 is a webcam from Sony Japan. An operating system command injection vulnerability exists in Sony NCP-HG100 version 1.4.48.16 and earlier, which stems from improper neutralization of a special element and can lead to remote command execution...
EUVD-2025-117076
Malicious code in special-brown-bobcat npm...