ruoyi-go SQL注入漏洞

ruoyi-go is a backend management system for individual developers at lostvip.com. A SQL injection vulnerability exists in ruoyi-go version 2.1, which originates from an incorrect operation of the parameter sortName in the file modules/system/dao/SysRoleDao.go in the component Background Managemen...

PT-2025-37101

Name of the Vulnerable Software and Affected Versions: ruoyi-go version 2.1 Description: A flaw exists in the SelectListPage function within the SysRoleDao.go file of the Background Management Page component. Manipulation of the sortName argument can lead to SQL injection. Remote exploitation is...

PyInstaller 代码注入漏洞

PyInstaller is a Python library from the Python Foundation that analyzes your code to discover all the other modules and libraries your scripts need to execute. A code injection vulnerability exists in PyInstaller versions prior to 6.0.0, which stems from improper handling of sys.path and could...

CVE-2025-52915

K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabli...

Malicious code in apachecn-sys-zh (npm)

The package apachecn-sys-zh was found to contain malicious code...

Malicious code in kssd-vol3-sys (npm)

The package kssd-vol3-sys was found to contain malicious code...

MAL-2025-44910 Malicious code in kssd-vol3-sys (npm)

The package kssd-vol3-sys was found to contain malicious code...

MAL-2025-43477 Malicious code in apachecn-sys-zh (npm)

The package apachecn-sys-zh was found to contain malicious code...

perf: Revert to requiring CAP_SYS_ADMIN for uprobes

...

CVE-2025-50755

Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsyscmd function via the command parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-50757

Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsysadm function via the username parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2024-48705

Wavlink AC1200 with firmware versions M32A3V1410230602 and M32A3V1410240222 are vulnerable to a post-authentication command injection while resetting the password. This vulnerability is specifically found within the "setsysadm" function of the "adm.cgi" binary, and is due to improper santization ...

CVE-2025-50757

Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsysadm function via the username parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-50757

The Wavlink WN535K3 wireless router (version 20191010 ) contains a command injection vulnerability in the set_sys_adm function. The flaw is caused by the improper handling of the username parameter, which allows an attacker to execute arbitrary commands via a crafted request. As a temporary worka...

PT-2025-35571

Name of the Vulnerable Software and Affected Versions: Wavlink WN535K3 version 20191010 Description: A command injection vulnerability exists in the set sys adm function of the Wavlink WN535K3 router. The vulnerability is triggered through manipulation of the username parameter, allowing attacker...

EUVD-2025-26405

Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the setsyscmd function via the command parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

Linux Distros Unpatched Vulnerability : CVE-2025-38499

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ubuntu Linux - cloneprivatemnt: make sure that caller has CAPSYSADMIN in the right userns What we want is to verify there is that clone won't expose something...

Linux Distros Unpatched Vulnerability : CVE-2023-50711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version...

CVE-2025-9650: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This affects the function removeFileByPath of the file src/main/java/com/yeqifu/sys/utils/AppFileUtils.java. The manipulation of the argument carimg leads to path traversal. The attack is possible t...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the /sys-api/role/update interface. An attacker can access sensitive data or disrupt normal system operations by sending specially crafted requests. Remediation Upgrade...