11796 matches found
PT-2026-93191
Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddns wan list show.cgi endpoint and related DDNSset cgi, IGD GetCgiHandler, and IGD CgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing...
CVE-2026-52484
An issue in MitraStar GPT-2742GX4X5v6-SV GLg2.5100XNT0b233 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...
CVE-2026-91003: Stack-based Buffer Overflow
A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzglasp of the file /rzgl.asp of the component CGI Service. This manipulation of the argument redircturl causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been...
PT-2026-91860
A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the...
EUVD-2026-78943
An issue in MitraStar GPT-2742GX4X5v6-SV GLg2.5100XNT0b233 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...
CVE-2026-52484: Improper Neutralization of Special Elements used in an OS Command
An issue in MitraStar GPT-2742GX4X5v6-SV GLg2.5100XNT0b233 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...
PT-2026-92170
An issue in MitraStar GPT-2742GX4X5v6-SV GL g2.5 100XNT0b23 3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...
PT-2026-93117
The affected products are missing authorization on state-changing CGIs and session checks are not performed...
CVE-2026-90881: Exposure of Sensitive Information to an Unauthorized Actor
A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the...
PT-2026-93198
NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval in qos xianz add cgi, qos xianz show cgi, qos filter add cgi, and qos filter show cgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stor...
Astra Linux – Vulnerability in Ruby 2.5
In the CGI gem before version 0.4.2 for Ruby, there is a Regular Expression Denial of Service ReDoS vulnerability in the UtilescapeElement method...
Astra Linux – Vulnerability in PHP 8.1, PHP 7.3
In PHP versions 8.1. before 8.1.30, and 8.2. before 8.2.24, as well as 8.3. before 8.3.12, the HTTPREDIRECTSTATUS variable was used to determine whether a CGI binary was being executed by the HTTP server. However, in certain scenarios, the content of this variable could be controlled by the reque...
Astra Linux – Vulnerability in mapserver
Versions of MapServer prior to 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 do not properly enforce the MSMAPNOPATH and MSMAPPATTERN restrictions, which are intended to control the locations from which a mapfile can be loaded via MapServer CG...
Astra Linux – Vulnerability in Ruby 2.5
In Ruby, the CGI::Cookie.parse method used from version 2.6.8 mishandles security prefixes in cookie names. This issue also affects the CGI gem used from version 0.3.0 in Ruby...
Astra Linux – Vulnerability in Apache2
A vulnerability in the Apache HTTP Server’s AllowOverride FileInfo directive allows for bypassing moduserdir+suexec. Users who have access to use the RequestHeader directive in htaccess can cause certain CGI scripts to run under an unexpected userid. This issue affects the Apache HTTP Server...
Astra Linux – Vulnerability in Jetty9
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to an org.eclipse.jetty.servlets.CGI Servlet for a binary file whose name contains...
Astra Linux – Vulnerability in Ruby 2.5
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allow HTTP response splitting. This is relevant for applications that use untrusted user input, either to generate an HTTP response or to create a CGI::Cookie object...
tomcat: Apache Tomcat: Security constraint bypass for CGI scripts
A flaw was found in the CGI servlet component of Apache Tomcat. This vulnerability allows a security constraint bypass via improper handling of case sensitivity in the pathInfo component of a URI mapped to the CGI servlet...
