CVE-2023-31852

CVE-2023-31852 affects Cudy LT400 firmware 1.13.4. The issue is a Cross Site Scripting (XSS) vulnerability in the web interface at cgi-bin/luci/admin/network/wireless/config, exploitable via the iface parameter. Connected documents confirm the affected product/version and the vulnerable parameter...

CVE-2023-31852: Improper Neutralization of Input During Web Page Generation

Cudy LT400 1.13.4 is vulnerable to Cross Site Scripting XSS in cgi-bin/luci/admin/network/wireless/config via the iface parameter...

CVE-2023-31851: Improper Neutralization of Input During Web Page Generation

Cudy LT400 1.13.4 is has a cross-site scripting XSS vulnerability in /cgi-bin/luci/admin/network/wireless/status via the iface parameter...

CVE-2023-31853: Improper Neutralization of Input During Web Page Generation

Cudy LT400 1.13.4 is vulnerable Cross Site Scripting XSS in /cgi-bin/luci/admin/network/bandwidth via the icon parameter...

CVE-2023-3380: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A vulnerability classified as critical has been found in Wavlink WN579X3 up to 20230615. Affected is an unknown function of the file /cgi-bin/adm.cgi of the component Ping Test. The manipulation of the argument pingIp leads to injection. It is possible to launch the attack remotely. The exploit h...

PT-2023-24503 · Wavlink · Wavlink Wn579X3

Name of the Vulnerable Software and Affected Versions: Wavlink WN579X3 versions up to 20230615 Description: A critical issue has been discovered, affecting an unknown function of the /cgi-bin/adm.cgi file in the Ping Test component. The manipulation of the pingIp argument leads to injection. This...

CVE-2023-29709

An issue was discovered in /cgi-bin/loginrj.cgi in Wildix WSG24POE version 103SP7D190822, allows attackers to bypass authentication...

CVE-2023-29709

An issue was discovered in /cgi-bin/loginrj.cgi in Wildix WSG24POE version 103SP7D190822, allows attackers to bypass authentication...

Design/Logic Flaw

An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factory reset via crafted payload...

PT-2023-22364 · Wavlink · Wavlink Wavrouter

Name of the Vulnerable Software and Affected Versions: WavLink WavRouter version RPT70HA1.x Description: An issue was discovered in "/cgi-bin/adm.cgi" that allows attackers to force a factory reset via a crafted payload. Recommendations: For WavLink WavRouter version RPT70HA1.x, as a temporary...

CVE-2023-29708: Incorrect Authorization

An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factory reset via crafted payload...

Atlassian Wildix WSG24POE 安全漏洞

The Atlassian Wildix WSG24POE is a networking device from Atlassian Australia. A security vulnerability exists in the Atlassian Wildix WSG24POE version 103SP7D190822, which originates from a security issue in cgi-bin/loginrj.cgi that allows an attacker to bypass authentication...

CVE-2023-29709: Undefined Security Weakness

An issue was discovered in /cgi-bin/loginrj.cgi in Wildix WSG24POE version 103SP7D190822, allows attackers to bypass authentication...

CVE-2023-3305: Improper Access Control

A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin/jumpto.php?class=user&page=configsave&isphp=1 of the component User Creation Handler. The manipulation of the argument user/newpassword...

CVE-2023-31729

TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi...

CVE-2023-31729

TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi...

CVE-2023-31729

TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi...

CVE-2023-31729: Improper Neutralization of Special Elements used in a Command

TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi...

CVE-2023-2682: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Caton Live up to 2023-04-26 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/ping.cgi of the component MiniHTTPD. The manipulation of the argument address with the input ;id;uname$IFS-a leads to command injection. The attack...

CVE-2023-2520

A vulnerability was found in Caton Prime 2.1.2.51.e8d7225049202303031001 and classified as critical. This issue affects some unknown processing of the file cgi-bin/toolsping.cgi?action=Command of the component Ping Handler. The manipulation of the argument Destination leads to command injection...