PT-2023-4094 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version 15.03.06.26 Description: The issue is related to a command injection vulnerability in the function formWriteFacMac, which can be exploited via the mac parameter. This vulnerability may allow a remote attacker to execute...

[M] Hardcoded address will not remain consistent across other chains

Lines of code Vulnerability details Impact The hardcoded address for the LBR token will not remain consistent across other chains, such as Polygon, Avalanche, Arbitrum and BSC for example. IEUSD0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2.balanceOfethlbrLpToken Proof of Concept Hardcoding the addre...

SQL Injection

in2code/ipandlanguageredirect is vulnerable to SQL Injection attacks. A specifically crafted attack statement through the $ipAddress parameter in the getCountryCodeFromIpInDatabase function allows a malicious user to inject and execute arbitrary SQL queries on the target system...

PT-2023-21974 · Zscaler · Client Connector

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A URL parameter during the login flow was vulnerable to injection, allowing an attacker to insert a malicious domain. This would redirect the user after authentication and send the...

NodCMS Cross Site Scripting vulnerability

Cross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows an attacker with administrative privileges to execute arbitrary code and gain access to sensitive information via a crafted script to the address parameter...

GHSA-7XQX-XWG9-JX34 NodCMS Cross Site Scripting vulnerability

Cross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows an attacker with administrative privileges to execute arbitrary code and gain access to sensitive information via a crafted script to the address parameter...

Cross site scripting

Cross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows a remote attacker to execute arbitrary code and gain access to senstivie information via a crafted script to the address parameter...

PT-2023-11558 · Khodakhah · Nodcms

Name of the Vulnerable Software and Affected Versions: khodakhah NodCMS version 3.0 Description: The issue allows a remote attacker to execute arbitrary code and gain access to sensitive information via a crafted script to the address parameter. This can be done by an attacker with administrative...

OTCMS 路径遍历漏洞

OTCMS Net Titanium CMS is a content management system CMS for article-based websites. A path traversal vulnerability exists in OTCMS versions prior to 6.62, which stems from path traversal due to incorrect manipulation of the parameter url...

CVE-2023-34942

Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the mac parameter at /start-apply.html. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2023-2159

The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmpbypass GET parameter in the URL equal to the md5-hashed homeurl in the default setting allows users to visit a site placed in maintenance mode th...

The vulnerability of the ping.cgi script in NETGEAR DGN2200 router’s embedded software allows a hacker to execute arbitrary commands and gain full control over the device.

The vulnerability of the ping.cgi script in NETGEAR DGN2200 router software exists because measures to neutralize specific elements used in the operating system command have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands on th...

CVE-2023-33617

An OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14X000 was found via the /boaform/admin/formPing targetaddr parameter...

CVE-2023-33617

An OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14X000 was found via the /boaform/admin/formPing targetaddr parameter...

Ellucian 跨站脚本漏洞

Ellucian is Ellucian's open and flexible technology ecosystem supporting SaaS. A cross-site scripting vulnerability exists in Ellucian Ethos Identity versions prior to 5.10.5, which stems from the presence of an unknown function in the file /cas/logout that leads to cross-site scripting via the...

Weaver E-Office 安全漏洞

Weaver E-Office is a collaborative office system from China's PanWei Technologies Weaver. A security vulnerability exists in Weaver E-Office version 9.5 and earlier versions, which is caused by an incorrect operation of the parameter url that results in absolute path traversal...

PT-2023-3384 · Tenda · Tenda Ac5

Name of the Vulnerable Software and Affected Versions: Tenda AC5 router version V15.03.06.28 Description: The issue is related to insufficient input validation in the Tenda AC5 router's firmware, which can be exploited by a remote attacker to execute arbitrary code using the Mac parameter at the...

The vulnerability of the ping.ccp component of the D-Link DIR820LA1 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the ping.ccp component of the D-Link DIR820LA1 router’s microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

CVE-2023-24729

Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the user profile update function...

Simple Customer Relationship Management SQL注入漏洞

Simple Customer Relationship Management Simple CRM is a simple customer relationship management system by Carlo Montero Personal Developer. A security vulnerability exists in Simple Customer Relationship Management System v1.0, which originates from a SQL injection vulnerability in the address...