CVE-2020-15033

NeDi 1.9C is vulnerable to cross-site scripting (XSS) via the snmpget.php ip parameter. Multiple connected sources (Red Hat advisory, CNVD, CNVD CNVD-2020-44580, NVD entry, OpenVAS entry, PRION, CVE record) confirm the same detail. The exact root cause is not elaborated beyond the parameter-based...

PT-2020-14420 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the ajax mod...

Cayin Signage Media Player 3.0 Root Remote Command Injection

!/usr/bin/env python3 Cayin Signage Media Player 3.0 Root Remote Command Injection Vendor: CAYIN Technology Co., Ltd. Product web page: https://www.cayintech.com Affected version: SMP-8000QD v3.0 SMP-8000 v3.0 SMP-6000 v3.0 Build 19025 SMP-6000 v1.0 Build 14246 SMP-6000 v1.0 Build 14199 SMP-6000...

Moxa AWK-3121 Buffer Overflow Vulnerability

Moxa AWK-3121 is an industrial-grade wireless access point from Moxa Taiwan, China. A buffer overflow vulnerability exists in the 'iwserverip' parameter in the Moxa AWK-3121 version 1.14, which can be exploited by an attacker to cause, for example, a buffer overflow or heap overflow...

CVE-2018-10703

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iwserverip" is susceptible ...

Command injection

The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainviewactivitymonitor&tab=activitytools request...

CVE-2018-15877

The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainviewactivitymonitor&tab=activitytools request...

PT-2018-13263 · Plainview · Plainview Activity Monitor

Name of the Vulnerable Software and Affected Versions: Plainview Activity Monitor plugin versions prior to 20180826 Description: The issue allows for OS command injection via shell metacharacters in the ip parameter of a "wp-admin/admin.php?page=plainview activity monitor&tab=activity tools"...

Moxa EDR-810 Command Injection Vulnerability (CNVD-2018-11722)

The EDR-810 is a highly integrated industrial multi-port security router with firewall/NAT/VPN and two-layer manageable switch functionality. A command injection vulnerability exists in the web server functionality of the Moxa EDR-810 V4.1 build 17030317. The vulnerability can be exploited to gai...

CVE-2017-12120

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation, resulting in a root shell. An attacker can inject OS commands into the ip= parm in the...

phpIPAM cross-site scripting vulnerability (CNVD-2018-09472)

phpIPAM is a set of open source PHP and MySQL based IP address management application IPAM. A cross-site scripting vulnerability exists in the app/sections/user-menu.php file in versions prior to phpIPAM 1.3.1. A remote attacker can exploit this vulnerability to inject arbitrary code or denial of...

Cross site scripting

Cross-site scripting XSS vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ip parameter...

Netsweeper Authentication Bypass Vulnerability

Netsweeper is a Web content filtering solution from Netsweeper Canada. A security vulnerability exists in Netsweeper versions prior to 3.1.10, 4.0.x prior to 4.0.9 and 4.1.x prior to 4.1.2. A remote attacker can exploit this vulnerability by sending the 'ip' parameter to the...

Command Execution Vulnerability in the ip Parameter of Kirin Fortress

Kirin Fortress is the open source operations and maintenance fortress. A command execution vulnerability exists in the ip parameter of the KyLinBarrier. Due to the lack of filtering of the parameter, an attacker can utilize the ip parameter to execute arbitrary commands...

PT-2017-4255 · Zyxel · Zyxel Emg2926

Name of the Vulnerable Software and Affected Versions: Zyxel EMG2926 version V1.00AAQT.4b8 Description: A command injection issue was discovered in the diagnostic tools of the Zyxel EMG2926 home router, specifically in the nslookup function. This allows a malicious user to execute arbitrary...

Server Side Request Forgery (SSRF) Vulnerability in AVTECH DVRs

AVTECH, founded in 1996, is one of the world's leading CCTV manufacturers. The main products are surveillance equipment, network cameras, network video recorders and so on. AVTECH DVR suffers from a server-side request forgery SSRF vulnerability. search.cgi provides search and access services for...

Cross site scripting

Cross-site scripting XSS vulnerability in Fortinet FortiWan formerly AscernLink before 4.2.5 allows remote attackers to inject arbitrary web script or HTML via the IP parameter to script/statistics/getconn.php...

Fortinet FortiWAN Cross-Site Scripting Vulnerability

Fortinet FortiWAN is a WAN link load balancing product developed by Fortinet. A cross-site scripting vulnerability exists in the IP parameter of the /script/statistics/getconn.php page in Fortinet FortiWAN. An attacker could exploit this vulnerability to execute arbitrary web script or HTML...

seacms /htdocs/seacms/reg.php ip参数 SQL注入

No description provided by source...

Cross site scripting

Cross-site scripting XSS vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Express 3.1 and 3.0 SP3 and earlier allows remote attackers to inject arbitrary web script or HTML via the IP parameter in a Run action...