215 matches found
CVE-2025-22604
CVE-2025-22604 affects Cacti, where a flaw in the multi-line SNMP result parser allows authenticated users to inject malformed OIDs; processing by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes() uses part of an OID as a key in an array that feeds a system command, causing a command execution vu...
WAVLINK AC3000 External Configuration Control Vulnerability (CNVD-2025-09258)
WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. The WAVLINK AC3000 suffers from an external configuration control vulnerability that originates from the openvpn.cgi openvpnserversetup function's openport parameter failing to correctly filter constructed command special characters,...
GHSA-8H93-28HG-FJ84 Composio Command Execution vulnerability
composio =0.5.40 is vulnerable to Command Execution in composioopenai, composioclaude, and composiojulep via the handletoolcalls function...
CVE-2024-53526
composio =0.5.40 is vulnerable to Command Execution in composioopenai, composioclaude, and composiojulep via the handletoolcalls function...
CVE-2024-56803 Ghostty improperly handles window title sequences which can lead to arbitrary command execution
Ghostty is a cross-platform terminal emulator. Ghostty, as allowed by default in 1.0.0, allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious...
webmin -- CGI Command Injection Remote Code Execution
Webmin reports: A less-privileged Webmin user can execute commands as root via a vulnerability in the shell autocomplete feature...
CVE-2024-56334
A flaw was found in the systeminformation library for Node.js. In Windows systems, the SSID parameter of the getWindowsIEEE8021x function is not sanitized before it is passed to cmd.exe. This may allow a remote attacker to execute arbitrary commands on the target system. Mitigation Mitigation for...
CVE-2024-55461
SeaCMS =13.0 is vulnerable to command execution in phome.php via the function EbakRepPathFiletext...
Tenda FH1201 Command Execution Vulnerability
The Tenda FH1201 is a wireless router from Tenda China. The Tenda FH1201 suffers from a command execution vulnerability that stems from a problem with the handler function in /goform/telnet, which can be exploited by an attacker to execute arbitrary commands via specially crafted HTTP requests...
Apache StreamPark: maven build params could trigger remote command execution
In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...
SeaCMS admin_config_mark.php Command Execution Vulnerability
SeaCMS is an open source content management system based on PHP+MySql technology. An input validation vulnerability exists in the SeaCMS adminconfigmark.php processing parameter, which can be exploited by a validated remote attacker to submit a special request and execute arbitrary commands in th...
Fortinet FortiOS Command Execution Vulnerability (CNVD-2024-29330)
Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. Fortinet FortiOS suffers from a...
PT-2024-4386
Name of the Vulnerable Software and Affected Versions Composer versions prior to 2.2.24 and 2.7.7 Description The issue is related to the incorrect neutralization of special elements in the getUnpushedChanges function of the Composer dependency manager for PHP. This can allow a remote attacker to...
PT-2024-5430 · Sysaid · Sysaid
Name of the Vulnerable Software and Affected Versions: SysAid affected versions not specified Description: The issue is related to the improper neutralization of special elements used in an OS command, which can allow a remote attacker to execute arbitrary commands. This is a critical issue that...
Command Execution Vulnerability in Business Integrated Management Platform of Puyuan Information Technology Company Limited (CNVD-2024-24191)
Puyuan Information Technology Co., Ltd. is a professional provider of software infrastructure platform products and solutions. A command execution vulnerability exists in the Business Integrated Management Platform of Puyuan Information Technology Co., Ltd. that can be exploited by an attacker to...
PT-2024-18382
Name of the Vulnerable Software and Affected Versions PHP versions prior to 8.1.29, prior to 8.2.20, and prior to 8.3.8 GHC versions 9.6.5, 9.8.3, and 9.10.1-alpha3 Description A command injection vulnerability exists in PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, and 8.3. before 8.3.8...
TOTOLINK EX1200L UploadFirmwareFil Interface Command Execution Vulnerability
TOTOLINK EX1200L is a dual-band wireless signal booster, mainly used to extend Wi-Fi coverage in home or office environments, solving the problem of weak signals or dead spots. The TOTOLINK EX1200L suffers from a command execution vulnerability that stems from the UploadFirmwareFil function...
TOTOLINK X6000R stun_user parameter command execution vulnerability
TOTOLINK X6000R is a wireless router from China Gion Electronics that supports WiFi 6 technology with high concurrent connections and dual-band transmission. TOTOLINK X6000R suffers from a command execution vulnerability, which originates from the sub4119A0 function's stunuser parameter failing t...
PT-2023-30008 · Totolink · Totolink X6000R
Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.652 B20230116 Description: A command execution issue was discovered via the sub 416F60 function, allowing for potential exploitation. Recommendations: For TOTOLINK X6000R version 9.4.0cu.652 B20230116, consider...