Filtered by CWE-77
Filtered by vendor Subscriptions
Total 3469 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-9585 1 Comfast 2 Cf-n1, Cf-n1 Firmware 2025-10-02 6.3 Medium
A vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilith_delete_pic_file of the file /usr/bin/webmgnt. This manipulation of the argument portal_delete_picname causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-9586 1 Comfast 2 Cf-n1, Cf-n1 Firmware 2025-10-02 6.3 Medium
A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such manipulation of the argument mac leads to command injection. The attack may be performed from a remote location. The exploit is publicly available and might be used.
CVE-2025-11092 2 D-link, Dlink 3 Dir-823x, Dir-823x, Dir-823x Firmware 2025-10-02 6.3 Medium
A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_switch_settings. This manipulation of the argument port causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
CVE-2025-11095 2 D-link, Dlink 3 Dir-823x, Dir-823x, Dir-823x Firmware 2025-10-02 6.3 Medium
A vulnerability was detected in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/delete_offline_device. Performing manipulation of the argument delvalue results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVE-2025-11096 2 D-link, Dlink 3 Dir-823x, Dir-823x, Dir-823x Firmware 2025-10-02 6.3 Medium
A flaw has been found in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/diag_traceroute. Executing manipulation of the argument target_addr can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used.
CVE-2025-11097 2 D-link, Dlink 3 Dir-823x, Dir-823x, Dir-823x Firmware 2025-10-02 6.3 Medium
A vulnerability has been found in D-Link DIR-823X 250416. Impacted is an unknown function of the file /goform/set_device_name. The manipulation of the argument mac leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-11098 2 D-link, Dlink 3 Dir-823x, Dir-823x, Dir-823x Firmware 2025-10-02 6.3 Medium
A vulnerability was found in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_wifi_blacklists. The manipulation of the argument macList results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.
CVE-2025-11099 2 D-link, Dlink 3 Dir-823x, Dir-823x, Dir-823x Firmware 2025-10-02 6.3 Medium
A vulnerability was determined in D-Link DIR-823X 250416. The impacted element is the function uci_del of the file /goform/delete_prohibiting. This manipulation of the argument delvalue causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-11100 2 D-link, Dlink 3 Dir-823x, Dir-823x, Dir-823x Firmware 2025-10-02 6.3 Medium
A vulnerability was identified in D-Link DIR-823X 250416. This affects the function uci_set of the file /goform/set_wifi_blacklists. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVE-2025-45512 1 Denx 1 U-boot 2025-10-02 6.5 Medium
A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attackers to install crafted firmware files, leading to arbitrary code execution.
CVE-2025-57105 1 Dlink 3 Di-7400g+, Di-7400g\+, Di-7400g\+ Firmware 2025-10-02 9.8 Critical
The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device. The sub_478D28 function in in mng_platform.asp, and sub_4A12DC function in wayos_ac_server.asp of the jhttpd program, with the parameter ac_mng_srv_host.
CVE-2025-29523 2 D-link, Dlink 3 Dsl-7740c, Dsl-7740c, Dsl-7740c Firmware 2025-10-01 7.2 High
D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the ping6 function.
CVE-2025-3816 1 Westboy 1 Cicadascms 2025-10-01 4.7 Medium
A vulnerability classified as critical was found in westboy CicadasCMS 2.0. This vulnerability affects unknown code of the file /system/schedule/save of the component Scheduled Task Handler. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-8983 1 Smashballoon 1 Custom Twitter Feeds 2025-09-30 4.8 Medium
Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-23971 1 Chargepoint 6 Home Flex Hardwired, Home Flex Hardwired Firmware, Home Flex Nema 14-50 Plug and 3 more 2025-09-30 8.8 High
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
CVE-2025-9934 1 Totolink 2 X5000r, X5000r Firmware 2025-09-29 6.3 Medium
A vulnerability was found in TOTOLINK X5000R 9.1.0cu.2415_B20250515. This affects the function sub_410C34 of the file /cgi-bin/cstecgi.cgi. Performing manipulation of the argument pid results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVE-2025-9935 1 Totolink 2 N600r, N600r Firmware 2025-09-29 7.3 High
A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstecgi.cgi. Executing manipulation can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2024-39914 1 Fogproject 1 Fogproject 2025-09-29 9.8 Critical
FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34.
CVE-2025-50989 1 Opnsense 1 Opnsense 2025-09-26 9.1 Critical
OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitrary shell operators and payloads. Successful exploitation results in remote code execution with the privileges of the web service (typically root), potentially leading to full system compromise or lateral movement. This vulnerability arises from inadequate input validation and improper handling of user-supplied data in backend command invocations.
CVE-2025-52046 1 Totolink 2 A3300r, A3300r Firmware 2025-09-26 9.8 Critical
Totolink A3300R V17.0.0cu.596_B20250515 was found to contain a command injection vulnerability in the sub_4197C0 function via the mac and desc parameters. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.