Total
3837 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-30461 | 1 Thedaylightstudio | 1 Fuel Cms | 2026-07-05 | N/A | 8.3 HIGH |
| Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule. | |||||
| CVE-2026-30352 | 2026-07-05 | N/A | 9.8 CRITICAL | ||
| A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter. | |||||
| CVE-2025-65363 | 1 Ruijie | 2 Rg-ap720-l, Rg-ap720-l Firmware | 2026-07-05 | N/A | 7.2 HIGH |
| Authenticated append-style command-injection Ruijie APs (AP_RGOS 11.1.x) allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the web_action.do endpoint. | |||||
| CVE-2025-63674 | 1 Blurams | 2 A31c, A31c Firmware | 2026-07-05 | N/A | 6.8 MEDIUM |
| An issue in Blurams Lumi Security Camera (A31C) v23.1227.472.2926 allows local physical attackers to execute arbitrary code via overriding the bootloader on the SD card. | |||||
| CVE-2025-57201 | 1 Avtech | 2 Dgm1104, Dgm1104 Firmware | 2026-07-05 | N/A | 8.8 HIGH |
| AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the SMB server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input. | |||||
| CVE-2025-57200 | 1 Avtech | 2 Dgm1104, Dgm1104 Firmware | 2026-07-05 | N/A | 6.5 MEDIUM |
| AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the test_mail function. This vulnerability allows attackers to execute arbitrary commands via a crafted input. | |||||
| CVE-2025-57199 | 1 Avtech | 2 Dgm1104, Dgm1104 Firmware | 2026-07-05 | N/A | 8.8 HIGH |
| AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the NetFailDetectD binary. This vulnerability allows attackers to execute arbitrary commands via a crafted input. | |||||
| CVE-2025-57198 | 1 Avtech | 2 Dgm1104, Dgm1104 Firmware | 2026-07-05 | N/A | 8.8 HIGH |
| AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the Machine.cgi endpoint. This vulnerability allows attackers to execute arbitrary commands via a crafted input. | |||||
| CVE-2025-45931 | 1 Dlink | 2 Dir-816, Dir-816 Firmware | 2026-07-05 | N/A | 9.8 CRITICAL |
| An issue D-Link DIR-816-A2 DIR-816A2_FWv1.10CNB05_R1B011D88210 allows a remote attacker to execute arbitrary code via system() function in the bin/goahead file | |||||
| CVE-2025-45619 | 1 Averusa | 2 Ptc310uv2, Ptc310uv2 Firmware | 2026-07-05 | N/A | 6.5 MEDIUM |
| An issue in Aver PTC310UV2 firmware v.0.1.0000.59 allows a remote attacker to execute arbitrary code via the SendAction function | |||||
| CVE-2025-25691 | 1 Prestashop | 1 Prestashop | 2026-07-05 | N/A | 6.5 MEDIUM |
| A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request. | |||||
| CVE-2026-36734 | 2026-07-05 | N/A | 8.8 HIGH | ||
| EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection. An authenticated attacker with access to the network can submit crafted input to the WLAN configuration functionality. Due to insufficient input validation, the attacker is able to execute arbitrary system commands on the device. | |||||
| CVE-2026-36540 | 2026-07-05 | N/A | 7.3 HIGH | ||
| Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skk_set.cgi endpoint. The password and new_pwd_confirm POST parameters are passed directly to the underlying OS shell without sanitization. An attacker can inject arbitrary shell commands by wrapping them in backticks (`) and encoding them in base64. Because the endpoint requires no authentication, any device on the LAN can achieve full Remote Code Execution on the router's operating system with a single HTTP POST request. | |||||
| CVE-2025-66738 | 1 Yealink | 2 Sip-t21\(p\)e2, Sip-t21\(p\)e2 Firmware | 2026-07-05 | N/A | 8.8 HIGH |
| An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component. | |||||
| CVE-2025-64052 | 1 Fanvil | 2 X210, X210 Firmware | 2026-07-05 | N/A | 5.1 MEDIUM |
| An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system commands. | |||||
| CVE-2025-63258 | 2026-07-05 | N/A | 6.5 MEDIUM | ||
| A remote command execution (RCE) vulnerability was discovered in all H3C ERG3/ERG5 series routers and XiaoBei series routers, cloud gateways, and wireless access points (versions R0162P07, UAP700-WPT330-E2265, UAP672-WPT330-R2262, UAP662E-WPT330-R2262P03, WAP611-WPT330-R1348-OASIS, WAP662-WPT330-R2262, WAP662H-WPT330-R2262, USG300V2-WPT330-R2129, MSG300-WPT330-R1350, and MSG326-WPT330-R2129). Attackers are able to exploit this vulnerability via injecting crafted commands into the sessionid parameter. | |||||
| CVE-2025-60838 | 1 Mingsoft | 1 Mcms | 2026-07-05 | N/A | 6.5 MEDIUM |
| An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file. | |||||
| CVE-2025-60687 | 1 Totolink | 2 Lr1200gb, Lr1200gb Firmware | 2026-07-05 | N/A | 6.5 MEDIUM |
| An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41EC68 function). The binary reads the "imei" parameter from a web request and verifies only that it is 15 characters long. The parameter is then directly inserted into a system command using sprintf() and executed with system(). Maliciously crafted IMEI input can execute arbitrary commands on the router without authentication. | |||||
| CVE-2025-60683 | 1 Totolink | 2 A720r, A720r Firmware | 2026-07-05 | N/A | 6.5 MEDIUM |
| A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary, specifically in the sub_40BFA4 function that handles network interface reinitialization from '/var/system/linux_vlan_reinit'. Input is only partially validated by checking the prefix of interface names, and is concatenated into shell commands executed via system() without escaping. An attacker with write access to this file can execute arbitrary commands on the device. | |||||
| CVE-2025-60682 | 1 Totolink | 2 A720r, A720r Firmware | 2026-07-05 | N/A | 6.5 MEDIUM |
| A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the cloudupdate_check binary, specifically in the sub_402414 function that handles cloud update parameters. User-supplied 'magicid' and 'url' values are directly concatenated into shell commands and executed via system() without any sanitization or escaping. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device. | |||||