1487 matches found
OS Command Injection in microweber/microweber
Description OS command injection also known as shell injection is a web security vulnerability that allows an attacker to execute arbitrary operating system OS commands on the server that is running an application, and typically fully compromise the application and all its data. Very often, an...
PT-2022-1874
Name of the Vulnerable Software and Affected Versions VP9 Video Extensions affected versions not specified Description The issue is related to incorrect code generation management in the VP9 Video Extensions package. An attacker can exploit this by sending a specially crafted request, potentially...
D-Link Di-7200G 命令注入漏洞
D-Link Di-7200G is a gigabit enterprise router from China Youxun D-Link. D-Link DI-7200G V2.E1 v21.04.09E1 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the path parameter...
Tenda G1 and G3 命令注入漏洞
The Tenda G1 and G3 are routers from the Chinese company Tenda. A command injection vulnerability exists in the Tenda G1 and G3 that can be exploited to execute arbitrary commands via the picname parameter...
CVE-2022-23871
Multiple cross-site scripting XSS vulnerabilities in the component outcomesaddProcess.php of Gibbon CMS v22.0.01 allow attackers to execute arbitrary web scripts or HTML via a crafted payload insterted into the name, category, description parameters...
CVE-2021-46253
A cross-site scripting XSS vulnerability in the Create Post function of Anchor CMS v0.12.7 allows attackers to execute arbitrary web scripts or HTML...
Anchor 跨站脚本漏洞
Anchor is an open source lightweight blogging system. A cross-site scripting vulnerability exists in Anchor CMS v0.12.7, which allows an attacker to exploit the vulnerability to execute arbitrary web script or HTML...
Reolink Rlc-410W 操作系统命令注入漏洞
Reolink Rlc-410W is a Wifi security camera from Reolink China.The device network settings feature of Reolink RLC-410W v3.0.0.13620121102 is vulnerable to OS command injection, which can be exploited by attackers to execute arbitrary commands...
Sql injection
SQL injection vulnerability in Login.php in Sourcecodester Online Payment Hub v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username parameter...
CVE-2021-41659
SQL injection vulnerability in Sourcecodester Banking System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username or password field...
gegl: shell expansion via a crafted pathname
Due to the use of the system command in the Magick-Load op used by gegl an attacker is able to craft a command line path that is able to lead to the execution of arbitrary shell commands that impacts availability, confidentiality and integrity...
AgentTesla Builder Web Panel Cross Site Scripting
Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/db9629508fda139f71f625d764c7eff7.txt Contact: [email protected] Media: twitter.com/malvuln Threat: AgentTesla Builder Web Panel Vulnerability: Cross Site Scripting XSS Description: AgentTeslaBuilder...
Sysaid Technologies SysAid SQL注入漏洞
Sysaid Technologies SysAid is an IT service management solution from Israel-based SysAid Technologies Sysaid Technologies.A SQL injection vulnerability exists in SysAid ITIL, which can be exploited by attackers to execute arbitrary SQL commands via the filterText parameter...
ROS-2-1164
2.1164 Multiple Vulnerabilities in Moodle 1. Vulnerability description: The vulnerability discovered allows a remote attacker to perform cross-site scripting XSS attacks. The vulnerability allows a remote user to gain unauthorized access to other restricted features. Vulnerability allows a remote...
Code injection
An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet...
The vulnerability of the Roundcube webmail client, related to the lack of measures taken to protect the SQL query structure, allows attackers to execute arbitrary SQL code.
The vulnerability of the Roundcube webmail client stems from the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL code using the search or searchparams parameters...
OS Command Injection in pixl-class
pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization...
GHSA-VM5J-VQR6-V7V8 OS Command Injection in pixl-class
pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization...
