23304 matches found
CVE-2026-7211
CVE-2026-7211 affects the dvladimirov MCP project (up to version 0.1.0) with a vulnerability in the Git Search API. The flaw is exposed in the function GitSearchRequest within mcp_server.py, where manipulating the argument repo_url/pattern can trigger a command injection. The issue is exploitable...
CVE-2026-7204
A vulnerability was determined in Totolink A8000RU 7.1cu.643b20200521. This issue affects the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument enable causes os command injection. The attack may be initiated remotely. The...
CVE-2026-7204
CVE-2026-7204 affects Totolink A8000RU (firmware 7.1cu.643_b20200521). The vulnerability resides in the CGI Handler’s setPptpServerCfg function within /cgi-bin/cstecgi.cgi, where manipulation of the enable argument enables an OS command injection. The issue is remotely exploitable and has had an ...
CVE-2026-7203
CVE-2026-7203 affects Totolink A8000RU (firmware 7.1cu.643_b20200521) in the CGI Handler component, specifically the function setUrlFilterRules in /cgi-bin/cstecgi.cgi. The argument enable can be manipulated to achieve OS command injection, enabling a remote attack. Exploit details are publicly a...
CVE-2026-7203 Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection
A vulnerability was found in Totolink A8000RU 7.1cu.643b20200521. This vulnerability affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be launched remotely...
EUVD-2026-25960
A vulnerability was found in Totolink A8000RU 7.1cu.643b20200521. This vulnerability affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be launched remotely...
CVE-2026-7203
A vulnerability was found in Totolink A8000RU 7.1cu.643b20200521. This vulnerability affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be launched remotely...
PT-2026-44835
Name of the Vulnerable Software and Affected Versions TRENDnet TEW-432BRP version 3.10B20 Description Remote command injection is possible through the manipulation of the peerPin argument within the formWPS function of the /goform/formWPS file. Command injection is a flaw that allows an attacker ...
TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32757)
TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics Corporation. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from an issue in the setWizardCfg function of the /cgi-bin/cstecgi.cgi file, where the input...
BinSoft mpGabinet 安全漏洞
BinSoft mpGabinet is a medical clinic management system developed by the Polish company BinSoft. Versions of BinSoft mpGabinet prior to December 23, 2021, contained security vulnerabilities. These vulnerabilities were due to issues with remote command execution, which could allow authorized users...
PT-2026-35829
Name of the Vulnerable Software and Affected Versions eiliyaabedini aider-mcp versions up to 667b914301aada695aab0e46d1fb3a7d5e32c8af Description A command injection issue exists within the code with ai component in the aider mcp.py file. A remote attacker can trigger this by manipulating the...
MyMCP 注入漏洞
MyMCP is a tool developed by Eiliya’s individual developer, capable of executing multiple AI coding tasks simultaneously. MyMCP has a vulnerability that stems from an unknown function parameter in the codewithai component, specifically the operation workingdir/editablefiles. This operation leads ...
PT-2026-44834
Name of the Vulnerable Software and Affected Versions TRENDnet TEW-432BRP version 3.10B20 Description Command injection is possible through the remote manipulation of the ip/mask/gateway argument within the formSetRoute function of the '/goform/formSetRoute' endpoint. Command injection is a flaw...
PT-2026-35647
Name of the Vulnerable Software and Affected Versions egtai gmx-vmd-mcp versions prior to 0.1.0 Description A command injection flaw exists in the VMD Launch Handler component within the launch vmd gui tool function of the mcp server.py file. A remote attacker can exploit this by manipulating the...
PT-2026-35690
A vulnerability was found in Totolink A8000RU 7.1cu.643 b20200521. This issue affects the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument wifiOff results in os command injection. The attack is possible to be carried...
PT-2026-35572
Name of the Vulnerable Software and Affected Versions Totolink A8000RU version 7.1cu.643 b20200521 Description OS command injection can be triggered remotely via the CGI Handler component. The issue exists in the setUrlFilterRules function within the '/cgi-bin/cstecgi.cgi' endpoint, where imprope...
CVE-2024-54012: Improper Neutralization of Special Elements used in an OS Command
Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing specially crafted requests containing malicious commands to be executed on the device. The manufacturer has released patch firmware for the flaw; please refer to...
CVE-2026-40552: Incorrect Resource Transfer Between Spheres
Multiple BinSoft products are vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an...
PT-2026-35693
A security flaw has been discovered in Totolink A8000RU 7.1cu.643 b20200521. The impacted element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge results in os command injection. It is possible to launch the...