Vulnerabilities (CVE)

Filtered by CWE-77
Total 2294 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2025-4357 1 Tendacn 2 Rx3, Rx3 Firmware 2025-05-13 5.8 MEDIUM 4.7 MEDIUM
A vulnerability was found in Tenda RX3 16.03.13.11_multi. It has been rated as critical. This issue affects some unknown processing of the file /goform/telnet. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-4443 1 Dlink 2 Dir-605l, Dir-605l Firmware 2025-05-13 6.5 MEDIUM 6.3 MEDIUM
A vulnerability was found in D-Link DIR-605L 2.13B01. It has been rated as critical. This issue affects the function sub_454F2C. The manipulation of the argument sysCmd leads to command injection. The attack may be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2025-4445 1 Dlink 2 Dir-605l, Dir-605l Firmware 2025-05-13 6.5 MEDIUM 6.3 MEDIUM
A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01. Affected is the function wake_on_lan. The manipulation of the argument mac leads to command injection. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2025-45492 1 Netgear 2 Ex8000, Ex8000 Firmware 2025-05-13 N/A 9.8 CRITICAL
Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function.
CVE-2025-45491 1 Linksys 2 E5600, E5600 Firmware 2025-05-13 N/A 9.8 CRITICAL
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the username parameter.
CVE-2025-45490 1 Linksys 2 E5600, E5600 Firmware 2025-05-13 N/A 9.8 CRITICAL
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the password parameter.
CVE-2025-45489 1 Linksys 2 E5600, E5600 Firmware 2025-05-13 N/A 9.8 CRITICAL
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostname parameter.
CVE-2025-45488 1 Linksys 2 E5600, E5600 Firmware 2025-05-13 N/A 9.8 CRITICAL
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailex parameter.
CVE-2025-45487 1 Linksys 2 E5600, E5600 Firmware 2025-05-13 N/A 9.8 CRITICAL
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection function.
CVE-2024-55466 2025-05-13 N/A 6.5 MEDIUM
An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2025-4453 1 Dlink 2 Dir-619l, Dir-619l Firmware 2025-05-13 6.5 MEDIUM 6.3 MEDIUM
A vulnerability was found in D-Link DIR-619L 2.04B04. It has been classified as critical. This affects the function formSysCmd. The manipulation of the argument sysCmd leads to command injection. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2025-4454 1 Dlink 2 Dir-619l, Dir-619l Firmware 2025-05-13 6.5 MEDIUM 6.3 MEDIUM
A vulnerability was found in D-Link DIR-619L 2.04B04. It has been declared as critical. This vulnerability affects the function wake_on_lan. The manipulation of the argument mac leads to command injection. The attack can be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2024-12442 2025-05-13 N/A 9.8 CRITICAL
EnerSys AMPA versions 24.04 through 24.16, inclusive, are vulnerable to command injection leading to privileged remote shell access.
CVE-2024-11861 2025-05-12 N/A 9.8 CRITICAL
EnerSys AMPA 22.09 and prior versions are vulnerable to command injection leading to privileged remote shell access.
CVE-2022-43367 1 Ip-com 2 Ew9, Ew9 Firmware 2025-05-12 N/A 9.8 CRITICAL
IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the formSetDebugCfg function.
CVE-2025-4122 1 Netgear 2 Jwnr2000v2, Jwnr2000v2 Firmware 2025-05-12 6.5 MEDIUM 6.3 MEDIUM
A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been rated as critical. Affected by this issue is the function sub_435E04. The manipulation of the argument host leads to command injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-44023 2025-05-12 N/A 6.5 MEDIUM
An issue in dlink DNS-320 v.1.00 and DNS-320LW v.1.01.0914.20212 allows an attacker to execute arbitrary via the account_mgr.cgi->cgi_chg_admin_pw components.
CVE-2025-3983 1 Amttgroup 1 Hotel Broadband Operating System 2025-05-12 5.8 MEDIUM 4.7 MEDIUM
A vulnerability has been found in AMTT Hotel Broadband Operation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /manager/system/nlog_down.php. The manipulation of the argument ProtocolType leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-1137 2025-05-12 N/A 7.5 HIGH
IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configurations, could allow an authenticated user to execute privileged commands due to improper input neutralization.
CVE-2025-29509 2025-05-12 N/A 8.8 HIGH
Jan v0.5.14 and before is vulnerable to remote code execution (RCE) when the user clicks on a rendered link in the conversation, due to opening external website in the app and the exposure of electronAPI, with a lack of filtering of URL when calling shell.openExternal().