782 matches found
CVE-2012-10059
Dolibarr ERP/CRM versions = 3.1.1 and = 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sqlcompat parameter, allowing authenticated users to inject arbitrary system commands, resulting in remote code...
CVE-2012-10059
Dolibarr ERP/CRM versions = 3.1.1 and = 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sqlcompat parameter, allowing authenticated users to inject arbitrary system commands, resulting in remote code...
CVE-2012-10059
Dolibarr ERP/CRM contains a post-authenticated OS command injection in its database backup feature. In versions <= 3.1.1 and
CVE-2012-10059 Dolibarr ERP/CRM Post-Auth OS Command Injection
Dolibarr ERP/CRM versions = 3.1.1 and = 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sqlcompat parameter, allowing authenticated users to inject arbitrary system commands, resulting in remote code...
CVE-2012-10059 Dolibarr ERP/CRM Post-Auth OS Command Injection
Dolibarr ERP/CRM versions = 3.1.1 and = 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sqlcompat parameter, allowing authenticated users to inject arbitrary system commands, resulting in remote code...
CVE-2024-13973
A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 21.0.1 can potentially lead to administrators achieving arbitrary code execution...
CVE-2024-13973
A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 21.0.1 can potentially lead to administrators achieving arbitrary code execution...
CVE-2024-13973
CVE-2024-13973 : A post-auth SQL injection vulnerability in the WebAdmin component of Sophos Firewall, affecting versions older than 21.0 MR1 (21.0.1). Exploitation could allow an administrator to achieve arbitrary code execution. The root cause is a SQL injection in WebAdmin; no exploit details ...
CVE-2024-13973
A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 21.0.1 can potentially lead to administrators achieving arbitrary code execution...
CVE-2025-7114
CVE-2025-7114 targets SimStudioAI sim up to commit 37786d371e17d35e0764e1b5cd519d873d90d97b. The flaw resides in the POST handler for apps/sim/app/api/files/upload/route.ts (Session Handler), where the Request can be manipulated without authentication, enabling remote, unauthenticated access. Mul...
CVE-2025-49215
A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this...
CVE-2025-49214
CVE-2025-49214 concerns Trend Micro Endpoint Encryption PolicyServer with an insecure deserialization flaw that could enable post-auth remote code execution. Affected component/behavior: deserialization function in PolicyServer; root cause described as insecure deserialization. Impact: high acros...
CVE-2025-49214
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this...
Trend Micro Endpoint Encryption PolicyServer SQLๆณจๅ ฅๆผๆด
Trend Micro Endpoint Encryption PolicyServer is a centralized management server from Trend Micro. A security vulnerability exists in Trend Micro Endpoint Encryption PolicyServer that stems from a post-authentication SQL injection issue that could result in elevated privileges...
Trend Micro Endpoint Encryption PolicyServer ๅฎๅ จๆผๆด
Trend Micro Endpoint Encryption PolicyServer is a centralized management server from Trend Micro. A security vulnerability exists in Trend Micro Endpoint Encryption PolicyServer that stems from a post-authentication SQL injection issue that could result in elevated privileges...
๐ Palo Alto PAN-OS CLI Crash
This Metasploit module triggers a denial-of-service condition in the CLI of Palo Alto PAN-OS by sending an overly long input after authentication. This module requires Metasploit Framework and compatible Ruby. require 'msf/core' require 'net/ssh' class MetasploitModule 'Palo Alto PAN-OS CLI Crash...
Roundcube Post-Auth RCE via PHP Object Deserialization
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. An attacker can execute arbitrary system commands as the...
CVE-2025-35009
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command...
CVE-2025-35008
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argume...
CVE-2025-35010
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command...