WS-2019-0262

Tomato, in all versions, is vulnerable to Command Injection. The /api/exec endpoint does not validate user input which allows attackers to run arbitrary commands in the system...