37 matches found
MajorDoMo - Cross-Site Scripting
MajorDoMo contains a reflected XSS caused by unsanitized $qry parameter in command.php, letting attackers inject arbitrary JavaScript via crafted URLs, exploit requires victim to visit malicious URL. id: CVE-2026-27176 info: name: MajorDoMo - Cross-Site Scripting author: DhiyaneshDk severity:...
CVE-2026-27176
MajorDoMo aka Major Domestic Module contains a reflected cross-site scripting XSS vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars, both in an input field value attribute and in a paragraph element. An attacker can...
CVE-2026-27176 MajorDoMo Reflected Cross-Site Scripting in command.php
MajorDoMo aka Major Domestic Module contains a reflected cross-site scripting XSS vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars, both in an input field value attribute and in a paragraph element. An attacker can...
CVE-2026-27176
MajorDoMo (Major Domestic Module) has a reflected XSS in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph element. An attacker can inject arbitrary JavaScript by crafting ...
CVE-2026-27176: Improper Neutralization of Input During Web Page Generation
MajorDoMo aka Major Domestic Module contains a reflected cross-site scripting XSS vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars, both in an input field value attribute and in a paragraph element. An attacker can...
PT-2026-20512
Name of the Vulnerable Software and Affected Versions MajorDoMo versions affected versions not specified Description MajorDoMo contains a reflected cross-site scripting XSS issue in the 'command.php' file. The $qry parameter is directly included in the HTML page without proper sanitization using...
EUVD-2013-7283
Malware in sbrugna...
The vulnerability in the command.php script of D-Link DIR-300 and DIR-600 router microprogramming software allows a hacker to gain unauthorized access to protected information and execute arbitrary commands.
The vulnerability of the command.php script in D-Link DIR-300 and DIR-600 router microprogramming systems is related to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability can allow an attacker, operating remotely, to ga...
CVE-2013-10069: Improper Neutralization of Special Elements used in an OS Command
The web interface of multiple D-Link routers, including DIR-600 rev B ≤2.14b01 and DIR-300 rev B ≤2.13, contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to...
CVE-2023-6901 codelyfe Stupid Simple CMS HTTP POST Request handle-command.php os command injection
A vulnerability, which was classified as critical, was found in codelyfe Stupid Simple CMS up to 1.2.3. This affects an unknown part of the file /terminal/handle-command.php of the component HTTP POST Request Handler. The manipulation of the argument command with the input whoami leads to os...
CVE-2023-6901: Improper Neutralization of Special Elements used in an OS Command
A vulnerability, which was classified as critical, was found in codelyfe Stupid Simple CMS up to 1.2.3. This affects an unknown part of the file /terminal/handle-command.php of the component HTTP POST Request Handler. The manipulation of the argument command with the input whoami leads to os...
The vulnerability of the D-Link DIR-610 network device’s microprogramming software arises from the lack of measures taken to neutralize the special elements used in the operating system commands. This vulnerability allows a hacker to execute arbitrary commands.
The vulnerability of the D-Link DIR-610 network device exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through the cmd parameter in the...
D-Link DIR-610 Remote Code Execution Vulnerability
The D-Link DIR-610 is a wireless router from AUO D-Link of Taiwan, China. A remote code execution vulnerability exists in the D-Link DIR-610, which arises from a failure of a network system or product to properly filter specific elements of externally entered data during the construction of a cod...
CVE-2020-9377
D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
Command injection
D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
CVE-2020-9377
D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
CVE-2020-9377: Improper Neutralization of Special Elements used in an OS Command
D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
OS Command Injection
mikehaertl/php-shellcommand is vulnerable to OS command injection. The addArg function in src/Command.php does not escape all arguments, allowing an attacker to inject arbitrary OS commands...
Zemra Botnet CnC Web Panel Remote Code Execution
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Zemra Botnet CnC Web Panel Remote Code Execution', 'Description' = %q This module exploits the CnC web panel of Zemra Botnet which...
