POC_CVE-2024-46256

POCCVE-2024-46256 CVE-2024-46256 and CVE-2024-46257 is the same POC, just change the provider param. Note Sometimes the nc file can't execute on the server or can't execute command! Install require pip install requests Run Exploit python3 POCCVE-2024-46256.py + Target type IP/Host? i/h: i + Enter...

CVE-2026-15095

The Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress is vulnerable to directory traversal in all versions up to and including 6.6.43 via the provider parameter. Authenticated attackers with Shop Manager or higher privileges can delete arbitrary files on the server by issuing t...

CVE-2026-15095: Improper Limitation of a Pathname to a Restricted Directory

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-31160

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the provider parameter to /cgi-bin/cstecgi.cgi...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32561)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from the setDdnsCfg function in the web management interface’s /cgi-bin/cstecgi.cgi file, which fails to...

TOTOLINK A8000RU 操作系统命令注入漏洞

TOTOLINK A8000RU is a wireless router produced by TOTOLINK, a Chinese company. The TOTOLINK A8000RU 7.1cu.643b20200521 version contains an operating system command injection vulnerability. This vulnerability stems from improper handling of the provider parameter in the setDdnsCfg function of the...

TOTOLINK A3300R provider parameter command injection vulnerability

The TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK A3300R provider parameter, which can be exploited by an attacker to execute arbitrary commands by sending a malicious request to the parameter...

EUVD-2026-25241

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the provider parameter to /cgi-bin/cstecgi.cgi...

CVE-2026-31160

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the provider parameter to /cgi-bin/cstecgi.cgi...

PT-2026-34671

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557 B20221024 allowing attackers to execute arbitrary commands via the provider parameter to /cgi-bin/cstecgi.cgi...

TOTOLINK A3300R 命令注入漏洞

The TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK A3300R provider parameter, which can be exploited by an attacker to execute arbitrary commands by sending a malicious request to the parameter...

CVE-2026-31160: Improper Neutralization of Special Elements used in a Command

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the provider parameter to /cgi-bin/cstecgi.cgi...

CVE-2026-31160

A command injection vulnerability exists in the ToToLink A3300R wireless router running firmware version v17.0.0cu.557_B20221024 . The flaw resides in the provider parameter of the /cgi-bin/cstecgi.cgi endpoint, where an attacker can execute arbitrary commands by sending a malicious request. This...

CVE-2026-31160

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the provider parameter to /cgi-bin/cstecgi.cgi...

The vulnerability of the setDdnsCfg function (/cgi-bin/cstecgi.cgi) in the Totolink A7100RU router’s microprogramming software allows a hacker to bypass existing security restrictions and execute arbitrary commands.

The vulnerability of the setDdnsCfg function /cgi-bin/cstecgi.cgi of the Totolink A7100RU router software relates to the failure to eliminate special elements used in the operating system’s command for processing the provider parameter. Exploiting this vulnerability allows a malicious actor to...

TOTOLINK A7100RU 操作系统命令注入漏洞

The TOTOLINK A7100RU is a wireless router produced by TOTOLINK, a Chinese company. The Totolink A7100RU 7.4cu.2313b20191024 version has a vulnerability related to operating system command injection. This vulnerability stems from incorrect handling of the parameter “provider” in the file...

CVE-2021-41950

A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php. Attackers can delete configuration or source code files, causing the...

Montala ResourceSpace 路径遍历漏洞

ResourceSpace is a digital asset management tool that enables users to organize their digital assets. a directory traversal vulnerability exists in ResourceSpace. An attacker could exploit the vulnerability to delete arbitrary files on the ResourceSpace server via the provider and variant...

PT-2021-23456 · Unknown · Resourcespace

Name of the Vulnerable Software and Affected Versions: ResourceSpace versions 9.6 through 9.6 rev 18277 Description: A directory traversal issue allows remote unauthenticated attackers to delete arbitrary files on the server via the provider and variant parameters in "pages/ajax/tiles.php"...

FS Gigs Script SQL Injection Vulnerability

FS Gigs Script is an online free market creation software based on PHP and MySQL. A SQL injection vulnerability exists in FS Gigs Script version 1.0. A remote attacker can inject SQL commands by sending the 'sc' parameter to the browse-category.php file or the 'ser' parameter to the...