CScms 安全漏洞

CScms Cheng CMS is a diversified content management system. A remote code execution vulnerability exists in the Playsong.php component of CScms version 4.1. An attacker can exploit this vulnerability to execute arbitrary commands...

BenQ EH600安全漏洞

The BenQ EH600 is an Android-based business smart projector from China's BenQ. A security vulnerability exists in the BenQ EH600 that stems from the BenQ smart wireless conference projector's management interface not properly controlling user privileges. An attacker can access any system director...

The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers such as Modicon M340, Modicon Quantum, and Modicon Premium lies in errors related to register data manipulation, allowing attackers to execute arbitrary commands.

The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers such as Modicon M340, Modicon Quantum, and Modicon Premium is related to errors in controlling registration data. Exploiting this vulnerability allows an attacker to execute arbitrary commands usi...

Exploit for SQL Injection in Schiocco Support_Board_-_Chat_And_Help_Desk

CVE-2021-24741 Multiple SQL Injection Unauthenticated...

CVE-2021-32758

OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute arbitrary commands via block methods. The latest OpenMage Versions up from v19.4.15 and v20.0.11 have this Issue patched...

CVE-2021-32758

OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute arbitrary commands via block methods. The latest OpenMage Versions up from v19.4.15 and v20.0.11 have this Issue patched...

CVE-2021-32758

CVE-2021-32758 affects OpenMage Magento LTS. Prior to versions 19.4.15 and 20.0.11, layout XML could enable admin users to execute arbitrary commands via block methods. The issue is patched in OpenMage versions starting from v19.4.15 and v20.0.11. Connected sources confirm the vulnerable conditio...

CyberPanel 2.1 Remote Code Execution

Title: CyberPanel 2.1 - Remote Code Execution RCE Authenticated Date: 27.08.2021 Author: Numan Türle Vendor Homepage: https://cyberpanel.net/ Software Link: https://github.com/usmannasir/cyberpanel Version: =2.1 https://www.youtube.com/watch?v=J8iLELVgkE !/usr/bin/python3 -- coding: utf-8 --...

D-Link DIR-816 Command Execution Vulnerability

D-Link DIR-816 is a wireless router from D-Link Taiwan, China.A security vulnerability exists in D-Link DIR-816A1FW101CNB04 750m11ac. The vulnerability is caused by a flaw in the handler function of the /goform/form2userconfig.cgi route. Through the use of HTTP request parameters, an attacker cou...

The vulnerability of the Administrative Interface component of the FortiMail email security system, which allows a hacker to execute arbitrary commands.

The vulnerability of the Administrative Interface component of the FortiMail email protection system relates to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

Sql injection

Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive controller, or the idcategory parameter to the...

CVE-2021-37538

Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive controller, or the idcategory parameter to the...

CVE-2021-36385

A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via a Fullwidth Apostrophe aka U+FF07 in the default.aspx User ID field. Arbitrary system commands can be executed through the use of xpcmdshell...

Sql injection

A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via a Fullwidth Apostrophe aka U+FF07 in the default.aspx User ID field. Arbitrary system commands can be executed through the use of xpcmdshell...

Command injection

A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php...

CVE-2021-36385

A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via a Fullwidth Apostrophe aka U+FF07 in the default.aspx User ID field. Arbitrary system commands can be executed through the use of xpcmdshell...

CVE-2021-38611

A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php...

F5 BIG-IP 操作系统命令注入漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A remote command execution vulnerability exists in the F5 BIG-IP TMUI, which can be exploited by an authenticated attacker wi...

F5 BIG-IP 操作系统命令注入漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An unspecified vulnerability exists in the F5 BIG-IP Advanced WAF and ASM TMUI, which, when cracked, allows an authenticated...

The vulnerability of the Brackets text editor, related to the lack of measures taken at the control level to clean up data, allows attackers to execute arbitrary commands.

The vulnerability of the Brackets text editor is related to the lack of measures taken at the control level to clean up data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the target system remotely...