PT-2024-4206 · Schneider Electric · Schneider Electric Sage

Name of the Vulnerable Software and Affected Versions: Schneider Electric Sage affected versions not specified Description: The issue is related to a buffer overflow in memory, which could allow a remote attacker to bypass authentication by sending a specially crafted POST request and setting...

CVE-2024-5785

Command injection vulnerability in Comtrend router WLD71-T1v2.0.201820, affecting the GRG-4280us version. This vulnerability could allow an authenticated user to execute commands inside the router by making a POST request to the URL “/boaform/admin/formUserTracert”...

CVE-2024-5785 Command injection vulnerability in Comtrend router

Command injection vulnerability in Comtrend router WLD71-T1v2.0.201820, affecting the GRG-4280us version. This vulnerability could allow an authenticated user to execute commands inside the router by making a POST request to the URL “/boaform/admin/formUserTracert”...

CVE-2024-5785 Command injection vulnerability in Comtrend router

Command injection vulnerability in Comtrend router WLD71-T1v2.0.201820, affecting the GRG-4280us version. This vulnerability could allow an authenticated user to execute commands inside the router by making a POST request to the URL “/boaform/admin/formUserTracert”...

CVE-2024-5785

CVE-2024-5785 refers to a command-injection vulnerability in the Comtrend router WLD71-T1_v2.0.201820, affecting the GRG-4280us version. The issue can allow an authenticated user to execute commands inside the device by sending a POST to /boaform/admin/formUserTracert. CVSSv3.1 vector: AV:A/AC:L/...

Comtrend router WLD71-T1 Operating System Command Injection Vulnerability

Comtrend router WLD71-T1 is a router from China Comtrend Telecom Comtrend. An operating system command injection vulnerability exists in the Comtrend Router WLD71-T1 v2.0.201820 version, which stems from susceptibility to command injection and could allow an authenticated user to execute commands...

CVE-2024-5771

A vulnerability classified as critical was found in LabVantage LIMS 2017. This vulnerability affects unknown code of the file /labvantage/rc?command=page&page=SampleList&iframename=list of the component POST Request Handler. The manipulation of the argument param1 leads to sql injection. The atta...

CVE-2024-5771 LabVantage LIMS POST Request sql injection

A vulnerability classified as critical was found in LabVantage LIMS 2017. This vulnerability affects unknown code of the file /labvantage/rc?command=page&page=SampleList&iframename=list of the component POST Request Handler. The manipulation of the argument param1 leads to sql injection. The atta...

LabVantage Solutions LIMS SQL Injection Vulnerability

LabVantage Solutions LIMS is a laboratory letter management system from LabVantage Solutions, USA. A SQL injection vulnerability exists in LabVantage Solutions LIMS version 2017, which stems from unknown code in the component POST Request Handler, which leads to an SQL injection via the param1...

Exploit for OS Command Injection in Php

CVE-2024-4577 Vulnerability Checker This script is designed t...

CVE-2024-3104 Remote Code Execution in mintplex-labs/anything-llm

A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the POST /api/system/update-env endpoint, which allows for the execution of...

PT-2024-24122 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm affected versions not specified Description: A vulnerability exists in the thread update process, allowing users with Default or Manager roles to escalate their privileges to Administrator. This issue arises from...

CVE-2024-29973

UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a...

CVE-2024-29973

UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a...

CVE-2024-29973

UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a...

CVE-2024-29972

UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the CGI program "remotehelp-cgi" in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by...

CVE-2024-29972

UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the CGI program "remotehelp-cgi" in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by...

The vulnerability of the /ms/file/upload.do file in the MCms content management system allows a hacker to upload any files they desire.

The vulnerability of the /ms/file/upload.do file in the MCms content management system is related to the ability to download files of a dangerous type without restrictions. Exploiting this vulnerability allows a malicious actor to download any files by sending a specially crafted POST request...

Aquatronica Control System 5.1.6 Password Disclosure

!/usr/bin/env python -- coding: utf-8 -- Aquatronica Control System 5.1.6 Passwords Leak Vulnerability Vendor: Aquatronica s.r.l. Product web page: https://www.aquatronica.com Affected version: Firmware: 5.1.6 Web: 2.0 Summary: Aquatronica's electronic AQUARIUM CONTROLLER is easy to use, allowing...

The vulnerability of the addVlan function (/view/networkConfig/vlan/vlan_add_commit.php) in the Tenda FH1206 router software allows a hacker to trigger a service failure.

The vulnerability of the addVlan function /view/networkConfig/vlan/vlanaddcommit.php of the Tenda FH1206 router software relates to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a malicious actor to execute...