10235 matches found
CVE-2021-27280
OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it gets selected...
CVE-2021-27280
The CVE-2021-27280 vulnerability affects mblog version 3.5.0 and is described as an OS command injection vulnerability that allows an attacker to execute arbitrary code through a crafted theme selected in the UI. The root cause is tied to what the sources label as a command injection weakness in ...
PT-2023-12116 · Mblog · Mblog
Name of the Vulnerable Software and Affected Versions: mblog version 3.5.0 Description: The issue allows attackers to execute arbitrary code via a crafted theme when it gets selected. This is due to an OS Command injection vulnerability. Recommendations: For mblog version 3.5.0, update to a newer...
CVE-2023-2564
OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0...
Command injection
OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0...
CVE-2023-2564 OS Command Injection in sbs20/scanservjs
OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0...
CVE-2023-2564 OS Command Injection in sbs20/scanservjs
OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0...
CVE-2023-2564
CVE-2023-2564 describes an OS Command Injection in sbs20/scanservjs before v2.27.0. The vulnerability arises in the server’s REST APIs for scanning and preview, where arrays of strings in POST bodies are interpolated into shell commands (via Process.spawn/scanimage), allowing an attacker to injec...
EasyPHP Webserver 14.1 - Multiple Vulnerabilities (RCE and Path Traversal) Exploit
Exploit Title: EasyPHP Webserver 14.1 - Multiple Vulnerabilities RCE and Path Traversal Discovery by: Rafael Pedrero Discovery Date: 2022-02-06 Vendor Homepage: https://www.easyphp.org/ Software Link : https://www.easyphp.org/ Tested Version: 14.1 Tested on: Windows 7 and 10 Vulnerability Type:...
EasyPHP Webserver 14.1 Path Traversal / Remote Code Execution
Exploit Title: EasyPHP Webserver 14.1 - Multiple Vulnerabilities RCE and Path Traversal Discovery by: Rafael Pedrero Discovery Date: 2022-02-06 Vendor Homepage: https://www.easyphp.org/ Software Link : https://www.easyphp.org/ Tested Version: 14.1 Tested on: Windows 7 and 10 Vulnerability Type:...
EasyPHP Webserver 14.1 - Multiple Vulnerabilities (RCE and Path Traversal)
Exploit Title: EasyPHP Webserver 14.1 - Multiple Vulnerabilities RCE and Path Traversal Discovery by: Rafael Pedrero Discovery Date: 2022-02-06 Vendor Homepage: https://www.easyphp.org/ Software Link : https://www.easyphp.org/ Tested Version: 14.1 Tested on: Windows 7 and 10 Vulnerability Type:...
Command injection
A vulnerability was found in Chengdu VEC40G 3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /sendorder.cgi?parameter=accessdetect of the component Network Detection. The manipulation of the argument COUNT with the input 3 | netstat -an...
CVE-2023-2522
CVE-2023-2522 affects Chengdu VEC40G 3.0 (Network Detection). The vulnerability lies in the /send_order.cgi?parameter=access_detect endpoint, where manipulating the COUNT argument with input like 3 | netstat -an causes os command injection. Exploitation is remote and has been publicly disclosed. ...
CVE-2023-27999
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...
CVE-2023-27999
CVE-2023-27999 affects FortiADC 7.2.0 and 7.1.0–7.1.1. It is an OS command injection due to improper neutralization of special elements (CWE-78) in FortiADC’s command handling, allowing an authenticated attacker to execute arbitrary commands via specially crafted arguments to existing commands. A...
CVE-2023-25826
Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was...
CVE-2023-25826
CVE-2023-25826 affects OpenTSDB via unauthenticated command injection in the HTTP query path (legacy API). The issue stems from insufficient validation of parameters (notably in the query API), allowing crafted commands to bypass regex filters and execute on the host. Public writeups and exploits...
CVE-2023-25826 Remote Code Execution in OpenTSDB
Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was...
FortiADC - Command injection in external resource module
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in FortiADC may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...