rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-34027 Versa Concerto Authentication Bypass File Write Remote Code Execution
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The Spack upload endpoint can be leveraged for a Time-of-Check to Time-of-Use (TOCTOU) write in combination with a race condition to achieve remote code execution via path loading manipulation, allowing an unauthenticated actor to achieve remote code execution (RCE).This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Versa
product: Concerto
default_status: unknown
Credits: lang: en
value: ProjectDiscovery
lang: en
value: Harsh Jaiswal
lang: en
value: Rahul Maini
lang: en
value: Parth Malhotra
Published: 2025-05-21T21:58:31.698Z
CVE-2025-34028 Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.





This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Commvault
product: Command Center Innovation Release
default_status: unaffected
Credits: lang: en
value: Sonny of watchTowr
Published: 2025-04-22T16:32:23.446Z
CVE-2025-34029 Edimax EW-7438RPn Mini OS Command Injection via syscmd.asp
An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler. The /goform/formSysCmd endpoint exposes a system command interface through the sysCmd parameter. A remote authenticated attacker can submit arbitrary shell commands directly, resulting in command execution as the root user. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-14 UTC.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Edimax
product: Edimax EW-7438RPn Mini
default_status: unaffected
Credits: lang: en
value: Besim Altinok
Published: 2025-06-20T18:38:15.689Z
CVE-2025-34030 sar2html OS Command Injection
An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject shell commands by appending them to the plot parameter (e.g., ?plot=;id) in a crafted GET request. The output of the command is displayed in the application's interface after interacting with the host selection UI. Successful exploitation leads to arbitrary command execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: sar2html
product: sar2html
default_status: unaffected
Credits: lang: en
value: Furkan Kayapinar
Published: 2025-06-20T18:40:04.545Z
CVE-2025-34031 Moodle LMS Jmol Plugin Path Traversal
A path traversal vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the query parameter in jsmol.php. The script directly passes user input to the file_get_contents() function without proper validation, allowing attackers to read arbitrary files from the server's filesystem by crafting a malicious query value. This vulnerability can be exploited without authentication and may expose sensitive configuration data, including database credentials. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Moodle
product: Jmol Plugin
default_status: unaffected
Credits: lang: en
value: Dionach by Nomios
Published: 2025-06-24T00:58:57.345Z
CVE-2025-34032 Moodle LMS Jmol Plugin Cross-site Scripting (XSS)
A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Moodle
product: Jmol Plugin
default_status: unaffected
Credits: lang: en
value: Dionach by Nomios
Published: 2025-06-24T00:59:26.844Z
CVE-2025-34033 5VTechnologies Blue Angel Software Suite OS Command Injection
An OS command injection vulnerability exists in the Blue Angel Software Suite running on embedded Linux devices via the ping_addr parameter in the webctrl.cgi script. The application fails to properly sanitize input before passing it to the system-level ping command. An authenticated attacker can inject arbitrary commands by appending shell metacharacters to the ping_addr parameter in a crafted GET request to /cgi-bin/webctrl.cgi?action=pingtest_update. The command's output is reflected in the application's web interface, enabling attackers to view results directly. Default and backdoor credentials can be used to access the interface and exploit the issue. Successful exploitation results in arbitrary command execution as the root user. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-26 UTC.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: 5VTechnologies
product: Blue Angel Software Suite
default_status: unaffected
Credits: lang: en
value: Paolo Serracino
lang: en
value: Pietro Minniti
lang: en
value: Damiano Proietti
Published: 2025-06-24T00:59:49.874Z
CVE-2025-34034 5VTechnologies Blue Angel Software Suite Hardcoded Credentials
A hardcoded credential vulnerability exists in the Blue Angel Software Suite deployed on embedded Linux systems. The application contains multiple known default and hardcoded user accounts that are not disclosed in public documentation. These accounts allow unauthenticated or low-privilege attackers to gain administrative access to the device’s web interface. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-26 UTC.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: 5VTechnologies
product: Blue Angel Software Suite
default_status: unaffected
Credits: lang: en
value: Paolo Serracino
lang: en
value: Pietro Minniti
lang: en
value: Damiano Proietti
Published: 2025-06-24T00:59:58.229Z
CVE-2025-34035 EnGenius EnShare IoT Gigabit Cloud Service Command Injection
An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: EnGenius
product: EnShare IoT Gigabit Cloud Service
default_status: unaffected
Credits: lang: en
value: Gjoko Krstic
Published: 2025-06-24T01:00:23.862Z
CVE-2025-34036 Shenzhen TVT CCTV-DVR Command Injection
An OS command injection vulnerability exists in white-labeled DVRs manufactured by TVT, affecting a custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82. The web interface fails to sanitize input in the URI path passed to the language extraction functionality. When the server processes a request to /language/[lang]/index.html, it uses the [lang] input unsafely in a tar extraction command without proper escaping. This allows an unauthenticated remote attacker to inject shell commands and achieve arbitrary command execution as root. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Shenzhen TVT
product: CCTV-DVR
default_status: unaffected
Credits: lang: en
value: Ophir Harpaz (k1p0d)
Published: 2025-06-24T01:00:52.579Z
CVE-2025-34037 Linksys Routers E/WAG/WAP/WES/WET/WRT-Series
An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm  in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Linksys
product: E4200
default_status: unaffected
vendor: Linksys
product: E3200
default_status: unaffected
vendor: Linksys
product: E3000
default_status: unaffected
vendor: Linksys
product: E2500 v1/v2
default_status: unaffected
vendor: Linksys
product: E2100L v1
default_status: unaffected
vendor: Linksys
product: E2000
default_status: unaffected
vendor: Linksys
product: E1550
default_status: unaffected
vendor: Linksys
product: E1500 v1
default_status: unaffected
vendor: Linksys
product: E1200 v1
default_status: unaffected
vendor: Linksys
product: E1000 v1
default_status: unaffected
vendor: Linksys
product: E900 v1
default_status: unaffected
Credits: lang: en
value: Johannes Ullrich of SANS Internet Storm Center
Published: 2025-06-24T01:03:27.693Z
CVE-2025-34038 Weaver E-cology SQL Injection
A SQL injection vulnerability exists in Weaver E-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Weaver
product: E-cology
default_status: unaffected
Credits: lang: en
value: r1ch4rd_L
Published: 2025-06-24T01:06:35.820Z
CVE-2025-34039 Yonyou NC BeanShell Command Injection
A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet (bsh.servlet.BshServlet) without proper access controls. The servlet allows unauthenticated remote attackers to execute arbitrary Java code via the bsh.script parameter. This can be exploited to run system commands and ultimately gain full control over the target server. The issue is rooted in a third-party JAR component bundled with the application, and the servlet is accessible without authentication on vulnerable installations. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Yonyou Co., Ltd.
product: UFIDA NC
default_status: unaffected
Credits: lang: en
value: Pursue Security
Published: 2025-06-24T01:07:05.619Z
CVE-2025-34040 Seeyon Zhiyuan OA System Path Traversal File Upload
An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.)
product: Zhiyuan OA Web Application System
default_status: unaffected
Credits: lang: en
value: Pursue Security
Published: 2025-06-24T01:12:22.769Z
CVE-2025-34041 Sangfor Endpoint Detection and Response OS Command Injection
An OS command injection vulnerability exists in the Chinese versions of Sangfor Endpoint Detection and Response (EDR) management platform versions 3.2.16, 3.2.17, and 3.2.19. The vulnerability allows unauthenticated attackers to construct and send malicious HTTP requests to the EDR Manager interface, leading to arbitrary command execution with elevated privileges. This flaw only affects the Chinese-language EDR builds. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Sangfor Technologies Co., Ltd.
product: Endpoint Detection and Response Platform
default_status: unaffected
Published: 2025-06-24T01:39:59.289Z
CVE-2025-34042 Beward N100 IP Camera Remote Command Execution
An authenticated command injection vulnerability exists in the Beward N100 IP Camera firmware version M2.1.6.04C014 via the ServerName and TimeZone parameters in the servetest CGI page. An attacker with access to the web interface can inject arbitrary system commands into these parameters, which are unsafely embedded into backend system calls without proper input sanitization. Successful exploitation results in remote code execution with root privileges. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-02 UTC.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Beward
product: N100 IP Camera
default_status: unaffected
Credits: lang: en
value: Gjoko Krstic of Zero Science
Published: 2025-06-26T15:51:13.423Z
CVE-2025-34043 Vacron NVR Remote Command Execution
A remote command injection vulnerability exists in Vacron Network Video Recorder (NVR) devices v1.4 due to improper input sanitization in the board.cgi script. The vulnerability allows unauthenticated attackers to pass arbitrary commands to the underlying operating system via crafted HTTP requests. These commands are executed with the privileges of the web server process, enabling remote code execution and potential full device compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Vacron
product: Network Video Recorder (NVR)
default_status: unaffected
Published: 2025-06-26T15:51:22.357Z
CVE-2025-34044 WIFISKY 7-Layer Flow Control Router Remote Command Execution
A remote command injection vulnerability exists in the confirm.php interface of the WIFISKY 7-layer Flow Control Router via a specially-crafted HTTP GET request to the t parameter. Insufficient input validation allows unauthenticated attackers to execute arbitrary OS commands. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-25 UTC.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Shenzhen Lingkong Technology
product: WIFISKY 7-layer flow control router
default_status: unaffected
Published: 2025-06-26T15:51:30.957Z
CVE-2025-34045 WeiPHP Path Traversal Arbitrary File Read
A path traversal vulnerability exists in WeiPHP 5.0, an open source WeChat public account platform development framework by Shenzhen Yuanmengyun Technology Co., Ltd. The flaw occurs in the picUrl parameter of the /public/index.php/material/Material/_download_imgage endpoint, where insufficient input validation allows unauthenticated remote attackers to perform directory traversal via crafted POST requests. This enables arbitrary file read on the server, potentially exposing sensitive information such as configuration files and source code. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Shenzhen Yuanmengyun Technology Co., Ltd.
product: WeiPHP
default_status: unaffected
Published: 2025-06-26T15:51:37.884Z
CVE-2025-34046 Fanwei E-Office Unauthenticated File Upload
An unauthenticated file upload vulnerability exists in the Fanwei E-Office <= v9.4 web management interface. The vulnerability affects the /general/index/UploadFile.php endpoint, which improperly validates uploaded files when invoked with certain parameters (uploadType=eoffice_logo or uploadType=theme). An attacker can exploit this flaw by sending a crafted HTTP POST request to upload arbitrary files without requiring authentication. Successful exploitation could enable remote code execution on the affected server, leading to complete compromise of the web application and potentially the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Shanghai Fanwei Network Technology
product: E-Office
default_status: unaffected
Published: 2025-06-26T15:51:45.664Z
CVE-2025-34047 Leadsec VPN Path Traversal Arbitrary File Read
A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the underlying system via the ostype parameter in the /vpn/user/download/client endpoint. This flaw arises from insufficient input sanitation, enabling traversal sequences to escape the intended directory and access sensitive files. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Beijing NetGuard Nebula Information Technology Co., Ltd.
product: Leadsec SSL VPN
default_status: unaffected
Published: 2025-06-26T16:10:37.548Z
CVE-2025-34048 D-Link DSL-2730U/2750U/2750E Path Traversal Arbitrary File Read
A path traversal vulnerability exists in the web management interface of D-Link DSL-2730U, DSL-2750U, and DSL-2750E ADSL routers with firmware versions IN_1.02, SEA_1.04, and SEA_1.07. The vulnerability is due to insufficient input validation on the getpage parameter within the /cgi-bin/webproc CGI script. This flaw allows an unauthenticated remote attacker to perform path traversal attacks by supplying crafted requests, enabling arbitrary file read on the affected device. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: D-Link
product: DSL-2730U
default_status: unaffected
vendor: D-Link
product: DSL-2750U
default_status: unaffected
vendor: D-Link
product: DSL-2750E
default_status: unaffected
Credits: lang: en
value: Todor Donev
Published: 2025-06-26T15:52:04.200Z
CVE-2025-34049 OptiLink ONT1GEW GPON Remote Code Execution
An OS command injection vulnerability exists in the OptiLink ONT1GEW GPON router firmware version V2.1.11_X101 Build 1127.190306 and earlier. The router’s web management interface fails to properly sanitize user input in the target_addr parameter of the formTracert and formPing administrative endpoints. An authenticated attacker can inject arbitrary operating system commands, which are executed with root privileges, leading to remote code execution. Successful exploitation enables full compromise of the device. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: OptiLink
product: ONT1GEW GPON
default_status: unaffected
Credits: lang: en
value: SecNigma
lang: en
value: Amal
Published: 2025-06-26T15:52:12.197Z
CVE-2025-34050 AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration without user interaction.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: AVTECH
product: IP cameras
default_status: unaffected
vendor: AVTECH
product: DVR devices
default_status: unaffected
vendor: AVTECH
product: NVR devices
default_status: unaffected
Credits: lang: en
value: Gergely Eberhardt (SEARCH-LAB.hu)
Published: 2025-07-01T14:42:57.143Z
CVE-2025-34051 AVTECH DVR Devices Server-Side Request Forgery
A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: AVTECH
product: DVR devices
default_status: unaffected
Credits: lang: en
value: Gergely Eberhardt (SEARCH-LAB.hu)
Published: 2025-07-01T14:44:22.913Z