CVE-2019-6810

CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module all firmware versions, which could cause the execution of commands by unauthorized users when using IEC 60870-5-104 protocol...

CVE-2019-15708

A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands...

CVE-2019-15710

An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted "execute date" commands...

CVE-2019-15419

The Asus ASUSX0151 Android device with a build fingerprint of asus/CNX015/ASUSX0151:7.0/NRD90M/CNX015-14.00.1709.35-20171215:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app versionCode=5, versionName=5.0.1 that allows unauthorized command...

CVE-2025-26268

DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service daemon crash via a crafted Redis command. The validity of the scan cursor was not checked...

CVE-2025-26003

Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution vulnerability when requesting the admin.cgi parameter with setAutorest...

CVE-2025-26003

Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution vulnerability when requesting the admin.cgi parameter with setAutorest...

CVE-2025-26003

CVE-2025-26003 affects Telesquare TLR-2005KSH 1.1.4. The vulnerability is an unauthorized command execution that occurs when requesting the admin.cgi parameter with setAutorest. The provided materials indicate a high-severity issue (CVSS 3.1: 9.8, Network ||/ Low attack complexity, no privileges ...

CVE-2025-1960

CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a system’s default password credentials have not been changed on first use. The default username is not displayed correctly in the WebHMI interfa...

CVE-2025-1960

CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a system’s default password credentials have not been changed on first use. The default username is not displayed correctly in the WebHMI interfa...

CVE-2024-54018

Multiple improper neutralization of special elements used in an OS Command vulnerabilities CWE-78 in FortiSandbox before 4.4.5 allows a privileged attacker to execute unauthorized commands via crafted requests...

CVE-2024-54018

CVE-2024-54018 affects Fortinet FortiSandbox prior to 4.4.5, where improper neutralization of special elements in OS commands (CWE-78) allows a privileged attacker to execute unauthorized commands via crafted requests. Impact per provided data includes high confidentiality, integrity, and availab...

CVE-2025-22368 Mennekes smart/premium charges systems, Command injection in sCU firmware update

The authenticated SCU firmware command of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS commands are improperly neutralized when certain fields are passed to the underlying OS...

CVE-2025-25528

Multiple buffer overflow vulnerabilities in Wavlink WL-WN575A3 RPT75A3.V4300, which are caused by not performing strict length checks on user-controlled data. By successfully exploiting the vulnerabilities, attackers can crash the remote devices or execute arbitrary commands without any...

CVE-2025-25528

Multiple buffer overflow vulnerabilities in Wavlink WL-WN575A3 RPT75A3.V4300, which are caused by not performing strict length checks on user-controlled data. By successfully exploiting the vulnerabilities, attackers can crash the remote devices or execute arbitrary commands without any...

CVE-2021-26106

An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow an authenticated attacker to execute unauthorized commands by running the kdbg CLI command with specifically crafted arguments...

CVE-2024-4638

OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in the web key upload function. An attacker could modify the intended commands sent to target functions, which could cause malicious users to execute unauthorized...

CVE-2024-4639

OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in IPSec configuration. An attacker could modify the intended commands sent to target functions, which could cause malicious users to execute unauthorized commands...

CVE-2024-53688

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier, which may allow a logged-in user to execute an arbitrary OS command using a crafted HTTP request...

PT-2025-23468

Name of the Vulnerable Software and Affected Versions Qualcomm chipsets affected versions not specified Meta Quest 3 and 3S versions August 7, 2025 and earlier Samsung S23 affected versions not specified Description A flaw exists in the Qualcomm Adreno GPU firmware that allows unauthorized comman...