CVE-2021-20745

Inkdrop (Markdown editor) is affected by CVE-2021-20745. Prior to v5.3.1, loading a file or code snippet containing an invalid iframe can lead to OS command injection, allowing arbitrary commands on the host. The vulnerability is tied to input handling of iframes. According to sources, affected v...

CVE-2021-20740

CVE-2021-20740 affects Hitachi Virtual File Platform and NEC Storage M Series NAS Gateway NH4x/NH8x. Impact: remote authenticated attacker can execute arbitrary OS commands with root privileges via unspecified vectors. Affected versions: Hitachi VFP < 5.5.3-09 and < 6.4.3-09; NEC M Series N...

CVE-2021-33357

A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated attacker to execute arbitrary OS commands...

Design/Logic Flaw

A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated attacker to execute arbitrary OS commands...

Design/Logic Flaw

Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpapassphrase" POST parameters in /hostapd, when the parameter values contain special characters such as ";" or "$" which enables an authenticated attacker to execute arbitrary OS commands...

CVE-2021-33357

A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated attacker to execute arbitrary OS commands...

CVE-2021-33358

RaspAP versions 2.3–2.6.5 contain command-injection vulnerabilities in the /hostapd endpoint via the interface, ssid, and wpa_passphrase POST parameters. Values containing special characters such as ; or $() may allow an authenticated attacker to execute arbitrary OS commands. Affects RaspAP’s we...

CVE-2021-33357

RaspAP versions 2.6–2.6.5 are affected by a remote command-injection vulnerability in /ajax/networking/get_netcfg.php where the iface parameter can include special characters (e.g., ";") to execute arbitrary OS commands. The issue is unauthenticated and can allow remote code execution. Affected s...

CVE-2021-33357

A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated attacker to execute arbitrary OS commands...

PT-2021-20125

Name of the Vulnerable Software and Affected Versions RaspAP versions 2.6 through 2.6.5 Description A vulnerability exists in the "iface" GET parameter in the /ajax/networking/get netcfg.php endpoint, where the iface parameter value containing special characters such as ";" enables an...

CVE-2021-33358: Improper Neutralization of Special Elements used in an OS Command

Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpapassphrase" POST parameters in /hostapd, when the parameter values contain special characters such as ";" or "$" which enables an authenticated attacker to execute arbitrary OS commands...

CVE-2021-20731: Improper Neutralization of Special Elements used in an OS Command

WSR-1166DHP3 firmware Ver.1.16 and prior and WSR-1166DHP4 firmware Ver.1.02 and prior allow an attacker to execute arbitrary OS commands with root privileges via unspecified vectors...

CVE-2021-26472

CVE-2021-26472 affects VembuBDR (pre-4.2.0.1) and VembuOffsiteDR (pre-4.2.0.1) on Windows. The http API at /consumerweb/secure/download.php allows an unauthenticated attacker to inject commands and execute arbitrary OS commands with SYSTEM privileges. No remediation details are provided in the co...

PT-2021-17018

Name of the Vulnerable Software and Affected Versions VembuBDR versions prior to 4.2.0.1 VembuOffsiteDR versions prior to 4.2.0.1 Description The issue allows an unauthenticated attacker to execute arbitrary OS commands with SYSTEM privileges. This can be achieved by exploiting the http API locat...

GHSA-H72C-W3Q3-55QQ OS Command Injection in jw.util

An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safeload is not used...

CVE-2020-26670: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function...

PT-2021-14177

Name of the Vulnerable Software and Affected Versions: RFNTPS firmware versions System 01000004 and earlier RFNTPS firmware versions Web 01000004 and earlier Description: The issue allows an attacker on the same network segment to execute arbitrary OS commands with a root privilege via unspecifie...

CVE-2021-32605

The CVE-2021-32605 entry concerns zzzcms/zzzphp before 2.0.4, where the parserIfLabel template processing fails to validate user-provided keys in the ?location=search flow, enabling remote code execution. The vulnerability allows an attacker to run arbitrary OS commands or code via a crafted keys...

CVE-2021-30228: Improper Neutralization of Special Elements used in an OS Command

The api/ZRAndlink/setZRAndlink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iandlinkprocenable parameter...

CVE-2020-22000

HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell commands as the web user via the 'setcommandon' and 'setcommandoff' POST parameters in...