Total
4000 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-57293 | 1 Comfast | 2 Cf-xr11, Cf-xr11 Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function in /usr/bin/webmgnt. The phy_interface parameter is not sanitized, allowing attackers to inject arbitrary commands via a POST request to /cgi-bin/mbox-config?method=SET§ion=multi_pppoe. When the action parameter is set to "one_click_redial", the unsanitized phy_interface is used in a system() call, enabling execution of malicious commands. This can lead to unauthorized access to sensitive files, execution of arbitrary code, or full device compromise. | |||||
| CVE-2025-57285 | 1 Codecept | 1 Codeceptjs | 2026-06-17 | N/A | 9.8 CRITICAL |
| codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands. | |||||
| CVE-2025-57164 | 1 Flowiseai | 1 Flowise | 2026-06-17 | N/A | 6.5 MEDIUM |
| Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field. | |||||
| CVE-2025-56799 | 1 Reolink | 1 Reolink | 2026-06-17 | N/A | 6.5 MEDIUM |
| Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folder name. NOTE: this is disputed by the Supplier because a crafted folder name would arise only if the local user were attacking himself. | |||||
| CVE-2025-56769 | 1 Hutool | 1 Hutool | 2026-06-17 | N/A | 6.5 MEDIUM |
| An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class. | |||||
| CVE-2025-56706 | 1 Edimax | 2 Br-6473ax, Br-6473ax Firmware | 2026-06-17 | N/A | 8.0 HIGH |
| Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution (RCE) vulnerability via the Object parameter in the openwrt_getConfig function. | |||||
| CVE-2025-56426 | 1 Webkul | 1 Bagisto | 2026-06-17 | N/A | 6.5 MEDIUM |
| An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logic fails to validate quantity inputs properly. | |||||
| CVE-2025-56425 | 1 Optimal-systems | 1 Enaio | 2026-06-17 | N/A | 9.1 CRITICAL |
| An issue was discovered in the AppConnector component version 10.10.0.183 and earlier of enaio 10.10, in the AppConnector component version 11.0.0.183 and earlier of enaio 11.0, and in the AppConnctor component version 11.10.0.183 and earlier of enaio 11.10. The vulnerability allows authenticated remote attackers to inject arbitrary SMTP commands via crafted input to the /osrest/api/organization/sendmail endpoint | |||||
| CVE-2025-56406 | 2026-06-17 | N/A | 7.5 HIGH | ||
| An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supplier's position is that authentication is not mandatory for MCP servers, and the mcp-neo4j MCP server is only intended for use in a local environment where authentication realistically would not be needed. Also, the Supplier provides middleware to help isolate the MCP server from external access (if needed). | |||||
| CVE-2025-55911 | 1 Oxygenz | 1 Clipbucket | 2026-06-17 | N/A | 6.5 MEDIUM |
| An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameter | |||||
| CVE-2025-55848 | 1 Dlink | 2 Dir-823x, Dir-823x Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the set_cassword settings interface, as the http_casswd parameter is not filtered by '&'to allow injection of reverse connection commands. | |||||
| CVE-2025-55824 | 1 Modstart | 1 Mostartcms | 2026-06-17 | N/A | 6.5 MEDIUM |
| ModStartCMS v9.5.0 has an arbitrary file write vulnerability, which allows attackers to write malicious files and execute malicious commands to obtain sensitive data on the server. | |||||
| CVE-2025-55637 | 1 Reolink | 2 Smart 2k\+ Plug-in Wi-fi Video Doorbell With Chime, Smart 2k\+ Plug-in Wi-fi Video Doorbell With Chime Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to contain a command injection vulnerability via the setddns_pip_system() function. | |||||
| CVE-2025-55591 | 1 Totolink | 2 A3002r, A3002r Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac parameter in the formMapDel endpoint. | |||||
| CVE-2025-55590 | 1 Totolink | 2 A3002r, A3002r Firmware | 2026-06-17 | N/A | 6.5 MEDIUM |
| TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an command injection vulnerability via the component bupload.html. | |||||
| CVE-2025-55372 | 1 Beakon | 1 Beakon | 2026-06-17 | N/A | 5.3 MEDIUM |
| An arbitrary file upload vulnerability in Beakon Application before v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file. | |||||
| CVE-2025-55319 | 1 Microsoft | 1 Visual Studio Code | 2026-06-17 | N/A | 8.8 HIGH |
| Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2025-55294 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| screenshot-desktop allows capturing a screenshot of your local machine. This vulnerability is a command injection issue. When user-controlled input is passed into the format option of the screenshot function, it is interpolated into a shell command without sanitization. This results in arbitrary command execution with the privileges of the calling process. This vulnerability is fixed in 1.15.2. | |||||
| CVE-2025-55283 | 1 Aiven | 1 Aiven-db-migrate | 2026-06-17 | N/A | 9.1 CRITICAL |
| aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows elevation to superuser inside PostgreSQL databases during a migration from an untrusted source server. The vulnerability stems from psql executing commands embedded in a dump from the source server. This vulnerability is fixed in 1.0.7. | |||||
| CVE-2025-55227 | 1 Microsoft | 4 Sql Server 2016, Sql Server 2017, Sql Server 2019 and 1 more | 2026-06-17 | N/A | 8.8 HIGH |
| Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | |||||