Exploit for OS Command Injection in Webmin

CVE-2019-15107 - Webmin RCE 💻🛑 The vulnerability is found in...

PT-2023-12131 · Unknown · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions prior to 2.2.16 Description: The issue allows remote attackers to execute arbitrary commands. This is achieved via the m1 sortby parameter to the "modules/News/function.admin articlestab.php" endpoint. Recommendations...

CVE-2021-28999

SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1sortby parameter to modules/News/function.adminarticlestab.php...

CMS Made Simple SQL注入漏洞

CMS Made Simple CMSMS is an open source content management system CMS by Cmsms team. The system supports role-based permission management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMS Made Simple version...

Victor CMS SQL注入漏洞

Victor CMS is an open source content management system from the individual developer Victor Alagwu in Nigeria. A security vulnerability exists in Victor CMS version 1.0, which stems from the presence of a SQL injection vulnerability that allows an attacker to execute arbitrary commands via a...

CVE-2021-28999

CMS Made Simple suffers an SQL injection in the m1_sortby parameter of modules/News/function.admin_articlestab.php, affecting versions up to 2.2.15. Root cause: improper validation allows remote command execution. Impact: high confidentiality, integrity, and availability (per CVSS) with remote at...

CVE-2023-30013

TOTOLINK X5000R V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter...

CVE-2023-30013

TOTOLINK X5000R V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter...

PT-2023-6552 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R versions V9.1.0u.6118 B20201102 through V9.1.0u.6369 B20230113 Description: The issue concerns a command insertion vulnerability in the setting/setTracerouteCfg component of the TOTOLINK X5000R router's firmware. This...

CVE-2023-30013

TOTOLINK X5000R V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter...

Rocky Linux 9 : emacs (RLSA-2023:2074)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:2074 advisory. - org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name...

CVE-2023-31415

Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of t...

Hotel Druid 跨站脚本漏洞

Hotel Druid is an open source program developed by DigitalDruid.Net for hotel management. A security vulnerability exists in Hotel Druid version 3.0.4, which stems from a stored cross-site scripting XSS vulnerability that allows execution of arbitrary commands...

CVE-2022-30759

In Nokia One-NDS aka Network Directory Server through 20.9, some Sudo permissions can be exploited by some users to escalate to root privileges and execute arbitrary commands...

Command injection

In Nokia One-NDS aka Network Directory Server through 20.9, some Sudo permissions can be exploited by some users to escalate to root privileges and execute arbitrary commands...

GHSA-59HW-J9G6-MFG3 Apache Spark UI vulnerable to Command Injection

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to...

PT-2023-3107 · Hitron · Hitron Coda-5310

Name of the Vulnerable Software and Affected Versions: Hitron CODA-5310 affected versions not specified Description: The issue exists due to insufficient measures to neutralize special elements used in the operating system command. A remote attacker, authenticated as an administrator, can exploit...

Oracle Linux 9 : emacs (ELSA-2023-2074)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-2074 advisory. 1:27.2-6.1 - Fix ob-latex.el command injection vulnerability 2180589 Tenable has extracted the preceding description block directly from the Oracle Linux securi...

CVE-2023-26781

SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center -Reader Comments -Search...

CVE-2023-30856 eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution

eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The projec...