The vulnerability of the cgi-bin/upload_firmware.cgi component of the D–Link DIR-823G router’s microprogramming system allows a hacker to cause a service failure.

The vulnerability of the cgi-bin/uploadfirmware.cgi component of the D–Link DIR-823G router’s microprogramming system is related to the lack of authentication. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2021-13795

Name of the Vulnerable Software and Affected Versions: Gryphon Tower router affected versions not specified Description: An unauthenticated command injection issue exists in the Gryphon Tower router’s web interface at "/cgi-bin/luci/rc". This allows an unauthenticated remote attacker on the same...

CVE-2021-20137: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/siteaccess/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link, granting the attacker javascript execution...

PT-2021-13794

Name of the Vulnerable Software and Affected Versions: Gryphon Tower router affected versions not specified Description: A reflected cross-site scripting issue exists in the url parameter of the "/cgi-bin/luci/site access/" page on the Gryphon Tower router's web interface. An attacker could explo...

Gryphon Tower 跨站脚本漏洞

A cross-site scripting vulnerability exists in Gryphon Tower, a wireless router from Gryphon. The vulnerability stems from a lack of user-supplied data and output data validation filtering in the url parameter of cgi-bin/luci/siteaccess/, which can be exploited to execute client-side JavaScript...

CVE-2021-20039: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances...

Cross site scripting

GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/routercgi?action=scanwifi XSS when an attacker creates an SSID with an XSS payload as the name...

CVE-2021-44148

GL.iNet GL-AR150 2.x before 3.x devices configured as repeaters are affected by a cross‑site scripting (XSS) vulnerability in cgi-bin/router_cgi?action=scanwifi. An attacker can embed an XSS payload in the SSID name, triggering XSS. This is documented in CVE-2021-44148 (NVD/NVD-derived descriptio...

PT-2021-24045

Name of the Vulnerable Software and Affected Versions: GL.iNet GL-AR150 versions 2.x through 2.x Description: The issue allows for XSS when an attacker creates an SSID with an XSS payload as the name, affecting devices configured as repeaters. This occurs through the cgi-bin/router...

CVE-2021-44148: Improper Neutralization of Input During Web Page Generation

GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/routercgi?action=scanwifi XSS when an attacker creates an SSID with an XSS payload as the name...

PT-2021-20928

Name of the Vulnerable Software and Affected Versions: Thruk versions 2.40 through 2 Description: The issue allows for Reflected XSS via the host or title parameter in the "/thruk/cgi-bin/status.cgi" endpoint. An attacker could inject arbitrary JavaScript into status.cgi, which would be triggered...

CVE-2020-25366: Missing Authorization

An issue in the component /cgi-bin/uploadfirmware.cgi of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service DoS via unspecified vectors...

Exploit for Path Traversal in Apache Http_Server

Apache 2.4.50 - Path Traversal or Remote Code Execution CVE-20...

Exploit for Path Traversal in Apache Http_Server

Apache 2.4.49 - Path Traversal or Remote Code Execution cve-20...

PT-2021-23503

Name of the Vulnerable Software and Affected Versions Visual Tools DVR VX16 version 4.2.28.0 Description An unauthenticated attacker can achieve remote command execution via shell metacharacters in the "cgi-bin/slogin/login.py" API endpoint, specifically in the User-Agent HTTP header...

CVE-2021-42071: Improper Neutralization of Special Elements used in an OS Command

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header...

CVE-2021-40284: Buffer Copy without Checking Size of Input

D-Link DSL-3782 EU v1.01:EU v1.03 is affected by a buffer overflow which can cause a denial of service. This vulnerability exists in the web interface "/cgi-bin/NewGUI/Igmp.asp". Authenticated remote attackers can trigger this vulnerability by sending a long string in parameter 'igmpsnoopEnable'...

PT-2021-22854

Name of the Vulnerable Software and Affected Versions D-Link DSL-3782 EU versions 1.01 through 1.03 Description The issue is a buffer overflow that can cause a denial of service. It exists in the web interface "/cgi-bin/New GUI/Igmp.asp". Authenticated remote attackers can trigger this issue by...

CVE-2021-40378: Missing Authorization

An issue was discovered on Compro IP70 2.087130218, IP570 2.087130520, IP60, and TN540 devices. /cgi-bin/support/killps.cgi deletes all data from the device...

PT-2021-22884

Name of the Vulnerable Software and Affected Versions Compro IP70 version 2.08 7130218 Compro IP570 version 2.08 7130520 Compro IP60 affected versions not specified Compro TN540 affected versions not specified Description An issue was discovered that affects the deletion of all data from the...