Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,928 results · page 9 of 39
Nov 7, 2025A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escapCVE-2025-10230 · Other software · Red Hat · reported by Red HatCritical 10
A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 5, 2025Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell CVE-2025-45379 · Other software · Dell · reported by security_alert@emc.comHigh 8.4
Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell access of system.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2025Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell.CVE-2025-45378 · Other software · Dell · reported by security_alert@emc.comCritical 9.1
Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A Privileged user with known password can break into command shell of CloudLink server and gain access of shell and escalate privilege, gain unauthorized access of system. If ssh is enabled with web credentials of server, attack is possible through network with known privileged user/password.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025By failing to authenticate three times to an unconfigured Abilis CPX device via SSH, an attacker can login to a restricted shell on the fourth attempt, and fromCVE-2025-35021 · Other software · Abilis · reported by cve@takeonme.orgMedium 6.5
By failing to authenticate three times to an unconfigured Abilis CPX device via SSH, an attacker can login to a restricted shell on the fourth attempt, and from there, relay connections.
- Product
- CPX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.abilis.nettakeonme.org
Nov 3, 2025Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet,CVE-2025-34501 · Other software · Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. · reported by VulnCheckHigh 7
Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through local or near-local access such as connecting to the USB or Ethernet ports beneath the table - the built-in credentials permit administrative login and full control of the system. Once authenticated, an attacker can access firmware utilities, modify controller software, and establish persistent compromise. Remote attack paths via network, cellular, or telemetry links may exist in specific configurations but generally require additional capabilities or operator error. The vendor reports that USB access has been disabled in current firmware builds.
- Product
- Deck Mate 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordioactive.comvulncheck.com
Oct 30, 2025Nagios XI versions prior to 2012R1.6 contain a shell command injection vulnerability in the Auto-Discovery tool.CVE-2013-10073 · Other software · Nagios · reported by VulnCheckHigh 8.7
Nagios XI versions prior to 2012R1.6 contain a shell command injection vulnerability in the Auto-Discovery tool. User-controlled input is passed to a shell without adequate sanitation or argument quoting, allowing an authenticated user with access to discovery functionality to execute arbitrary commands with the privileges of the application service.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 29, 2025On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.CVE-2025-54545 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.8
On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.
- Product
- DANZ Monitoring Fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access viCVE-2025-1037 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 7.5
By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell (SSH) to an unrestricted root shell. This is possible through abuse of a particular set of scripts and executables that allow for certain commands to be run as root from an unprivileged context.
- Product
- TropOS 4th Gen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Oct 24, 2025An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a CVE-2025-4106 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3High 8.9
An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.watchguard.comwatchguard.com
Oct 24, 2025OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown CVE-2025-10680 · Other software · OpenVPN · reported by security@openvpn.netHigh 8.8
OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netmail-archive.com
Oct 22, 2025D-Link DIR-823G A1 v1.0.2B05 was discovered to contain a buffer overflow in the FillMacCloneMac parameter in the /EXCU_SHELL endpoint.CVE-2025-60331 · Other software · Dlink · reported by MITREHigh 7.5
D-Link DIR-823G A1 v1.0.2B05 was discovered to contain a buffer overflow in the FillMacCloneMac parameter in the /EXCU_SHELL endpoint. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Product
- Dir-823g Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2025An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.CVE-2025-7851 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 8.7
An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.
- Product
- Omada gateways
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.omadanetworks.comforescout.com
Oct 20, 2025Reolink Video Doorbell WiFi DB_566128M5MP_W allows root shell access through an unsecured UART/serial console.CVE-2025-60856 · Other software · reported by MITREMedium 6.8
Reolink Video Doorbell WiFi DB_566128M5MP_W allows root shell access through an unsecured UART/serial console. An attacker with physical access can connect to the exposed interface and execute arbitrary commands with root privileges. NOTE: this is disputed by the Supplier because of "certain restrictions on users privately connecting serial port cables" and because "the root user has a password and it meets the requirements of password security complexity."
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybermaya.inreolink.com
Oct 15, 2025When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, arbitrary syCVE-2025-60013 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 4.6
When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, arbitrary system commands may be executed, and the FIPS hardware security module (HSM) may fail to initialize. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- F5OS - Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource admiCVE-2025-59481 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.5
A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to execute arbitrary system commands with higher privileges. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.CVE-2025-59244 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.CVE-2025-59185 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.CVE-2025-25004 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.
- Product
- PowerShell 7.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2025Enterprise Cloud Database developed by Ragic has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell baCVE-2025-11675 · Other software · Ragic · reported by twcert@cert.org.twHigh 8.6
Enterprise Cloud Database developed by Ragic has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- Product
- Enterprise Cloud Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 9, 2025NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nCVE-2017-20203 · Other software · NetSarang Computer, Inc. · reported by VulnCheckCritical 9.3
NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nssock2.dll that implements a multi-stage, DNS-based backdoor. The dormant library contacts a C2 DNS server via a specially crafted TXT record for a month‑generated domain. After receiving a decryption key, it then downloads and executes arbitrary code, creates an encrypted virtual file system (VFS) in the registry, and grants the attacker full remote code execution, data exfiltration, and persistence. NetSarang released builds for each product line that remediated the compromise: Xmanager Enterprise Build 1236, Xmanager Build 1049, Xshell Build 1326, Xftp Build 1222, and Xlpd Build 1224. Kaspersky Lab identified an instance of exploitation in the wild in August 2017.
- Product
- Xmanager Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurelist.comusa.kaspersky.com
Sep 29, 2025Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gain access to the debug shell exposed via TCVE-2025-57428 · Other software · reported by MITREMedium 6.5
Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gain access to the debug shell exposed via Telnet on Port 23 and execute hardware-level flash and register manipulation commands.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, granting shell accesCVE-2025-59815 · Other software · Zenitel · reported by cert@ncsc.nlHigh 8.4
This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, granting shell access. Exploitation can compromise the device’s availability, confidentiality, and integrity.
- Product
- ICX500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zenitel.comwiki.zenitel.com
Sep 16, 2025A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell aCVE-2025-37127 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell access. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, potentially leading to unauthorized access and control over the affected systems.
- Product
- HPE Aruba Networking EdgeConnect SD-WAN Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025psPAS PowerShell module does not explicitly enforce TLS 1.2 within the 'Get-PASSAMLResponse' function during the SAML authentication process.CVE-2025-59270 · Other software · pspete · reported by 9119a7d8-5eab-497f-8521-727c672e3725Low 2.3
psPAS PowerShell module does not explicitly enforce TLS 1.2 within the 'Get-PASSAMLResponse' function during the SAML authentication process. An unauthenticated attacker in a 'Man-in-the-Middle' position could manipulate the TLS handshake and downgrade TLS to a deprecated protocol. Fixed in 7.0.209.
- Product
- psPAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used.CVE-2025-59377 · Other software · feiskyer · reported by MITRELow 3.7
feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used. NOTE: this is unrelated to mcp-server-kubernetes and CVE-2025-53355.
- Product
- mcp-kubernetes-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the server, leading to remCVE-2025-57642 · Other software · Sohamjuhin · reported by MITREHigh 7.2
A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the server, leading to remote code execution and unauthorized access to the system. This can result in the compromise of sensitive data and system functionality.
- Product
- Tourism Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.CVE-2025-49734 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.
- Product
- PowerShell 7.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI.CVE-2025-48395 · Other software · Eaton · reported by CybersecurityCOE@eaton.comMedium 4.7
An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version of NMC G2 which is available on the Eaton download center.
- Product
- NMC G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy.CVE-2025-32324 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Sep 2, 2025E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist butCVE-2025-52548 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191Medium 6.9
E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025The RunCommand function accepts any parameter, which is then passed for execution in the shell.CVE-2025-30056 · Other software · CGM · reported by cvd@cert.plCritical 9.4
The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2025A non-primary administrator user with admin rights to the web interface but without shell access permissions can display configuration of the device including tCVE-2025-36729 · Other software · RACOM · reported by vulnreport@tenable.comHigh 7.2
A non-primary administrator user with admin rights to the web interface but without shell access permissions can display configuration of the device including the master admin password. This vulnerability also allows the user to give themselves shell access with the root gid.
- Product
- M!DGE2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2025Mitrastar GPT-2741GNAC-N2 devices are provided with access through ssh into a restricted default shell.The command "deviceinfo show file" is supposed to be usedCVE-2025-50753 · Other software · reported by MITREHigh 8.4
Mitrastar GPT-2741GNAC-N2 devices are provided with access through ssh into a restricted default shell.The command "deviceinfo show file" is supposed to be used from restricted shell to show files and directories. By providing " /bin/sh" (quotes included) to the argument of this command will drop a root shell.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3CVE-2025-41451 · Other software · Danfoss · reported by d7ff35af-cf88-454c-bab9-af60602f10f8High 8.7
Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.
- Product
- AK-SM8xxA Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025A Path Traversal vulnerability in AllSky v2023.05.01 through v2024.12.06_06 allows an unauthenticated attacker to create a webshell and remote code execution viCVE-2024-44373 · Other software · reported by MITRECritical 9.8
A Path Traversal vulnerability in AllSky v2023.05.01 through v2024.12.06_06 allows an unauthenticated attacker to create a webshell and remote code execution via the path, content parameter to /includes/save_file.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgh0stmezh.wordpress.comgithub.com
Aug 6, 2025An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI.CVE-2025-48394 · Other software · Eaton · reported by CybersecurityCOE@eaton.comMedium 4.7
An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version which is available on the Eaton download center.
- Product
- G4 PDU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a ManCVE-2025-48393 · Other software · Eaton · reported by CybersecurityCOE@eaton.comMedium 5.7
The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version of Eaton G4 PDU which is available on the Eaton download center.
- Product
- G4 PDU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025NVIDIA Triton Inference Server contains a vulnerability in the HTTP server, where an attacker could start a reverse shell by sending a specially crafted HTTP reCVE-2025-23317 · Other software · NVIDIA · reported by psirt@nvidia.comCritical 9.1
NVIDIA Triton Inference Server contains a vulnerability in the HTTP server, where an attacker could start a reverse shell by sending a specially crafted HTTP request. A successful exploit of this vulnerability might lead to remote code execution, denial of service, data tampering, or information disclosure.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Aug 5, 2025The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that gCVE-2025-2611 · Other software · ICT Innovations · reported by VulnCheckCritical 9.3
The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.
- Product
- ICTBroadcast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 30, 2025The e-School from Ventem has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, therebyCVE-2025-8323 · Other software · Ventem · reported by twcert@cert.org.twHigh 8.7
The e-School from Ventem has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- Product
- e-School
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 23, 2025Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web ShellCVE-2025-54446 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comCritical 9.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shell to a Web Server.This issue affects MagicINFO 9 Server: less than 21.1080.0
- Product
- MagicINFO 9 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungtv.com
Jul 23, 2025Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web ShellCVE-2025-54443 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comCritical 9.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shell to a Web Server.This issue affects MagicINFO 9 Server: less than 21.1080.0
- Product
- MagicINFO 9 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungtv.com
Jul 23, 2025Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web ShellCVE-2025-54438 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comCritical 9.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shell to a Web Server.This issue affects MagicINFO 9 Server: less than 21.1080.0
- Product
- MagicINFO 9 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungtv.com
Jul 19, 2025Thor before 1.4.0 can construct an unsafe shell command from library input.CVE-2025-54314 · Other software · rubyonrails · reported by MITRELow 2.8
Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."
- Product
- Thor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A vulnerability in the ascgshell, of Brocade ASCG before 3.3.0 stores any command executed in the Command Line Interface (CLI) in plain text within the commanCVE-2025-7397 · Other software · Broadcom · reported by sirt@brocade.comMedium 6.8
A vulnerability in the ascgshell, of Brocade ASCG before 3.3.0 stores any command executed in the Command Line Interface (CLI) in plain text within the command history. A local authenticated user that can access sensitive information like passwords within the CLI history leading to unauthorized access and potential data breaches.
- Product
- Brocade ASCG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2025Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the aCVE-2013-3307 · Network & remote access · Linksys · reported by MITREHigh 8.3
Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000.
- Product
- E1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet.CVE-2025-34093 · Other software · Polycom · reported by VulnCheckHigh 7.5
An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet. The lan traceroute command in the devcmds console accepts unsanitized input, allowing attackers to execute arbitrary system commands. By injecting shell metacharacters through the traceroute interface, an attacker can achieve remote code execution under the context of the root user. This flaw affects systems where Telnet access is enabled and either unauthenticated access is allowed or credentials are known.
- Product
- HDX Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comstaaldraad.github.io
Jul 9, 2025A user with vpuser credentials that opens an SSH connection to the device, gets a restricted shell rbash that allows only a small list of allowed commands.CVE-2025-27027 · Other software · Radiflow · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 4.1
A user with vpuser credentials that opens an SSH connection to the device, gets a restricted shell rbash that allows only a small list of allowed commands. This vulnerability enables the user to get a full-featured Linux shell, bypassing the rbash restrictions.
- Product
- iSAP Smart Collector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Numeric truncation error in Windows Shell allows an authorized attacker to elevate privileges locally.CVE-2025-49679 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Numeric truncation error in Windows Shell allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2025In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows authenticated attackeCVE-2025-47228 · Other software · ScriptCase · reported by MITREMedium 6.7
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows authenticated attackers to execute system commands via crafted HTTP requests.
- Product
- ScriptCase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comscriptcase.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.