MajorDoMo - Cross-Site Scripting

MajorDoMo contains a reflected XSS caused by unsanitized $qry parameter in command.php, letting attackers inject arbitrary JavaScript via crafted URLs, exploit requires victim to visit malicious URL. id: CVE-2026-27176 info: name: MajorDoMo - Cross-Site Scripting author: DhiyaneshDk severity:...

CVE-2026-112301

A security flaw exists in orbitale imagemagick-php up to version 3.3.5 . The vulnerability is located in the Command::font function within the src/Command.php file. Improper handling of the fontFile argument allows for remote OS command injection . Public exploits for this vulnerability are avail...

CVE-2026-112301 orbitale imagemagick-php Command.php font os command injection

A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been...

D-Link DIR-300 & DIR-600 RCE

Module exploits D-Link DIR-300, DIR-600 Remote Code Execution vulnerability which allows executing command on operating system level with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-600 RCE""" from kittysploit import from lib.protocols.http.httpclient import...

D-Link DIR-300/600 - command.php RCE Detection (CVE-2013-10048)

Detects CVE-2013-10048/10069 by POSTing cmd=ls -l /; to /command.php with Cookie uid=vttest. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300/600 command.php RCE CVE-2013-10048 / CVE-2013-10069.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DIR-300/600 - command.php RCE (CVE-2013-10048)

Exploits CVE-2013-10048 via POST /command.php with Cookie uid=vttest. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300/600 command.php RCE CVE-2013-10048 — opens execute session.""" from kittysploit import from lib.protocols.http.httpclient import...

MajorDoMo - Cross-Site Scripting Detection

MajorDoMo contains a reflected XSS caused by unsanitized $qry parameter in command.php, letting attackers inject arbitrary JavaScript via crafted URLs, exploit requires victim to visit malicious URL. !/usr/bin/env python3 -- coding: utf-8 -- """MajorDoMo contains a reflected XSS caused by...

CVE-2026-27176

MajorDoMo aka Major Domestic Module contains a reflected cross-site scripting XSS vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars, both in an input field value attribute and in a paragraph element. An attacker can...

CVE-2026-27176

MajorDoMo (Major Domestic Module) has a reflected XSS in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph element. An attacker can inject arbitrary JavaScript by crafting ...

CVE-2026-27176 MajorDoMo Reflected Cross-Site Scripting in command.php

MajorDoMo aka Major Domestic Module contains a reflected cross-site scripting XSS vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars, both in an input field value attribute and in a paragraph element. An attacker can...

CVE-2026-27176: Improper Neutralization of Input During Web Page Generation

MajorDoMo aka Major Domestic Module contains a reflected cross-site scripting XSS vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars, both in an input field value attribute and in a paragraph element. An attacker can...

PT-2026-20512

Name of the Vulnerable Software and Affected Versions MajorDoMo versions affected versions not specified Description MajorDoMo contains a reflected cross-site scripting XSS issue in the 'command.php' file. The $qry parameter is directly included in the HTML page without proper sanitization using...

EUVD-2013-7283

Malware in sbrugna...

D-Link DIR-300/DIR-600 Router Unauthenticated Command Execution

The vulnerability of the command.php script in D-Link DIR-300 and DIR-600 router microprogramming systems is related to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability can allow an attacker, operating remotely, to ga...

CVE-2013-10069: Improper Neutralization of Special Elements used in an OS Command

The web interface of multiple D-Link routers, including DIR-600 rev B ≤2.14b01 and DIR-300 rev B ≤2.13, contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to...

PT-2024-35076

Name of the Vulnerable Software and Affected Versions Arris VAP2500 version 08.50 Description A critical issue has been discovered, affecting an unknown part of the file /tools command.php. The manipulation of the cmb header/txt command argument leads to command injection. It is possible to...

CVE-2023-6901 codelyfe Stupid Simple CMS HTTP POST Request handle-command.php os command injection

A vulnerability, which was classified as critical, was found in codelyfe Stupid Simple CMS up to 1.2.3. This affects an unknown part of the file /terminal/handle-command.php of the component HTTP POST Request Handler. The manipulation of the argument command with the input whoami leads to os...

CVE-2023-6901

A vulnerability, which was classified as critical, was found in codelyfe Stupid Simple CMS up to 1.2.3. This affects an unknown part of the file /terminal/handle-command.php of the component HTTP POST Request Handler. The manipulation of the argument command with the input whoami leads to os...

CVE-2023-6901: Improper Neutralization of Special Elements used in an OS Command

A vulnerability, which was classified as critical, was found in codelyfe Stupid Simple CMS up to 1.2.3. This affects an unknown part of the file /terminal/handle-command.php of the component HTTP POST Request Handler. The manipulation of the argument command with the input whoami leads to os...

D-Link DIR-610 Command Injection

The vulnerability of the D-Link DIR-610 network device exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through the cmd parameter in the...