Command injection

Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php...

CVE-2018-20727

CVE-2018-20727 affects NeDi prior to 1.7Cp3. The vulnerability allows authenticated users to perform server-side command execution via user-controlled parameters: flt (Nodes-Traffic.php), dv (Devices-Graph.php), or tit (drawmap.php). This is a command-injection flaw arising from insufficient inpu...

CVE-2018-20727: Improper Neutralization of Special Elements used in an OS Command

Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php...

PT-2019-10185

Name of the Vulnerable Software and Affected Versions: NeDi versions prior to 1.7Cp3 Description: The issue allows authenticated users to execute code on the server side. This can be achieved via the flt parameter to "Nodes-Traffic.php", the dv parameter to "Devices-Graph.php", or the tit paramet...