CVE-2024-2910

CVE-2024-2910 affects Ruijie RG-EG350 (pre-20240318) in the VPN quick set service. The vulnerable component is the HTTP POST handler function vpnAction in the file /itbox_pi/vpn_quickset_service.php?a=set_vpn. By manipulating arguments ip, port, user, pass, dns, or startIp, an attacker can trigge...

CVE-2024-2909 Ruijie RG-EG350 HTTP POST Request setAction os command injection

A vulnerability classified as critical was found in Ruijie RG-EG350 up to 20240318. Affected by this vulnerability is the function setAction of the file /itboxpi/networksafe.php?a=set of the component HTTP POST Request Handler. The manipulation of the argument bandwidth leads to os command...

CVE-2024-2909 Ruijie RG-EG350 HTTP POST Request setAction os command injection

A vulnerability classified as critical was found in Ruijie RG-EG350 up to 20240318. Affected by this vulnerability is the function setAction of the file /itboxpi/networksafe.php?a=set of the component HTTP POST Request Handler. The manipulation of the argument bandwidth leads to os command...

CVE-2024-2909

CVE-2024-2909 affects Ruijie RG-EG350 up to 20240318. The vulnerability resides in the HTTP POST Request Handler function setAction (file /itbox_pi/networksafe.php?a=set) where manipulation of the bandwidth argument enables OS command injection. It can be exploited remotely; multiple sources conf...

DEBIAN-CVE-2024-29025

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The HttpPostRequestDecoder can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits ...

UBUNTU-CVE-2024-29025

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The HttpPostRequestDecoder can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits ...

phpMyFAQ Stored Cross-site Scripting at FAQ News Content

Summary By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. PoC 1. Edit a FAQ news, intercept the request and modify the news parameter in the POST body with the following...

GHSA-6P68-36M6-392R phpMyFAQ Stored Cross-site Scripting at FAQ News Content

Summary By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. PoC 1. Edit a FAQ news, intercept the request and modify the news parameter in the POST body with the following...

CVE-2024-28106

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. This vulnerability i...

CVE-2024-28106 phpMyFAQ Stored XSS at FAQ News Content

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. This vulnerability i...

CVE-2024-28106

Summary: CVE-2024-28106 affects phpMyFAQ, an open source FAQ app. The vulnerability is a stored Cross‑Site Scripting (XSS) in the “news” parameter of a POST request, allowing an attacker to inject JavaScript that executes when a user visits the affected news page. Root cause: inadequate sanitizat...

CVE-2024-24725

Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/importrun.php&type=externalAssessment&step=4 URI...

Exploit for SQL Injection in Nagios Nagios_Xi

CVE-2023-48084 Fixes broken syntax in the POC, primarily incor...

CVE-2024-24725

Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/importrun.php&type=externalAssessment&step=4 URI...

CVE-2024-25239

SQL Injection vulnerability in Sourcecodester Employee Management System v1.0 allows attackers to run arbitrary SQL commands via crafted POST request to /emloyeeakpoly/Account/login.php...

CVE-2024-25239

SQL Injection vulnerability in Sourcecodester Employee Management System v1.0 allows attackers to run arbitrary SQL commands via crafted POST request to /emloyeeakpoly/Account/login.php...

CVE-2024-27683

D-Link Go-RT-AC750 GORTAC750A1FWv101b03 contains a stack-based buffer overflow via the function hnapmain. An attacker can send a POST request to trigger the vulnerablilify...

PT-2024-5013 · D Link · D-Link Go-Rt-Ac750

Name of the Vulnerable Software and Affected Versions: D-Link Go-RT-AC750 version GORTAC750 A1 FW v101b03 Description: The issue is related to a stack-based buffer overflow via the hnap main function. An attacker can send a POST request to trigger the issue, potentially allowing a remote attacker...

CVE-2024-27683

D-Link Go-RT-AC750 GORTAC750A1FWv101b03 contains a stack-based buffer overflow via the function hnapmain. An attacker can send a POST request to trigger the vulnerablilify...

CVE-2024-27683

D-Link Go-RT-AC750 (GORTAC750_A1_FW_v101b03) is affected by a stack-based buffer overflow in the hnap_main function. An attacker can trigger this via a crafted POST request to the vulnerable API, potentially enabling arbitrary code execution or causing device instability/DoS. Public details indic...