CVE-2025-20258

MEDIUM Year: 2025
CVSS v3 Score
5.4
Medium
Weakness Type
CWE-77
View all →

Vulnerability Description

A vulnerability in the self-service portal of Cisco Duo could allow an unauthenticated, remote attacker to inject arbitrary commands into emails that are sent by the service. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary commands into a portion of an email that is sent by the service. A successful exploit could allow the attacker to send emails that contain malicious content to unsuspecting users.

Related Vulnerabilities

CVE-2019-16012

MEDIUM
CVSS:5.4(Medium)

A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists b...

CWE-772019

CVE-2024-28328

MEDIUM
CVSS:5.4(Medium)

CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which can be triggered and executed in a differe...

CWE-772024

CVE-2025-25768

MEDIUM
CVSS:5.4(Medium)

MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary ...

CWE-772025

CVE-2025-26056

MEDIUM
CVSS:5.4(Medium)

A command injection vulnerability exists in the Infinxt iEdge 100 2.1.32 in the Troubleshoot module "MTR" functionality. The vulnerability is due to improper validation of user-supplied input in the m...

CWE-772025

CVE-2017-1352

MEDIUM
CVSS:5.5(Medium)

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by another user that downloads the affected file. IBM X-Force ID: 1...

CWE-772017

CVE-2018-8306

MEDIUM
CVSS:5.5(Medium)

A command injection vulnerability exists in the Microsoft Wireless Display Adapter (MWDA) when the Microsoft Wireless Display Adapter does not properly manage user input, aka "Microsoft Wireless Displ...

CWE-772018