CVE-2025-13442
A security vulnerability has been detected in UTT 进取 750W up to 3.2.2-191225. Affected by this vulnerability is the function system of the f
CVSS
7.3
High
EPSS
19.5%
p97
KEV
—
Exploit Today
29
0-100
Published: Nov 20, 2025 · Last modified: Oct 18, 2026 · CWE-74 · CWE-77
19.5%EPSS · 30 days19.5%
2026-09-252026-10-23
A security vulnerability has been detected in UTT 进取 750W up to 3.2.2-191225. Affected by this vulnerability is the function system of the file /goform/formPdbUpConfig. Such manipulation of the argument policyNames leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-57209——
——0Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.18hCVE-2026-1157303.1 LOW—
——0i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.19hCVE-2026-942634.8 MED—
——0The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.1dCVE-2026-1050149.1 CRI51.3%
——15Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.10hCVE-2026-957156.8 MED4.9%
——1An unauthenticated command injection vulnerability exists in the command line interface of AOS-10. Successful exploitation could allow an attacker with physical access to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.18hCVE-2026-957097.2 HIG29.4%
——9Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.10h