The vulnerability of TP-Link Deco M4 Mesh-system’s microprogramming software lies in the lack of measures to neutralize specific elements, allowing attackers to execute arbitrary commands.

The vulnerability of Mesh-system TP-Link Deco M4’s microprogramming software is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of TP-Link Archer C20 router’s microprogramming software, related to deficiencies in authentication procedures, allows attackers to execute arbitrary commands.

The vulnerability of TP-Link Archer C20 router’s microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending specially crafted requests...

The vulnerability of the RocketMQ messaging platform, related to improper code generation, allows attackers to execute arbitrary commands.

The vulnerability of the RocketMQ messaging platform is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

PT-2023-6719 · Ilias · Ilias

Name of the Vulnerable Software and Affected Versions: ILIAS version 7.25 Description: The issue is related to the exec function in the execQuoted method of the ilUtil class, which lacks input sanitization. This allows attackers to inject malicious commands into the system, potentially compromisi...

PT-2023-5605 · D Link · D-Link Dar-7000

Name of the Vulnerable Software and Affected Versions: D-Link DAR-7000 versions up to 20151231 Description: The issue is related to an unrestricted file upload vulnerability in the /sysmanage/updateos.php file of the D-Link DAR-7000 router's firmware. This vulnerability can be exploited remotely,...

PT-2023-5603 · D Link · D-Link Dar-8000 +1

Name of the Vulnerable Software and Affected Versions: D-Link DAR-7000 versions up to 20151231 D-Link DAR-8000 versions up to 20151231 Description: The issue is related to an unrestricted file upload vulnerability in the /sysmanage/updatelib.php file of the D-Link DAR-7000 and DAR-8000 router...

PT-2023-5602 · D Link · D-Link Dar-8000

Name of the Vulnerable Software and Affected Versions: D-Link DAR-8000 versions up to 20151231 Description: The issue is related to an unrestricted file upload vulnerability in the /sysmanage/changelogo.php file of the D-Link DAR-8000 router's firmware. This vulnerability can be exploited remotel...

CVE-2023-43270

dst-admin v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the userId parameter at /home/playerOperate...

Command injection

dst-admin v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the userId parameter at /home/playerOperate...

The vulnerability of the hybrid cloud management platform Acronis Cloud Manager lies in insufficient validation of input data, allowing arbitrary commands to be executed.

The vulnerability of Acronis Cloud Manager, a platform for managing hybrid clouds, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary commands...

dst-admin Code Injection Vulnerability

dst-admin is a web program written in Java by qinming99, an individual developer. A security vulnerability exists in dst-admin v1.5.0, which is caused by a Remote Command Execution RCE vulnerability in the parameter userId of the component /home/playerOperate...

PT-2023-27751 · Unknown · Juplink Rx4-1500

Name of the Vulnerable Software and Affected Versions: Juplink RX4-1500 versions V1.0.2 through V1.0.5 Description: The issue allows remote authenticated attackers to execute commands via specially crafted requests to the vulnerable endpoint "homemng.htm". This enables attackers to inject command...

CVE-2023-43270

dst-admin v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the userId parameter at /home/playerOperate...

CVE-2023-43270

dst-admin v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the userId parameter at /home/playerOperate...

CVE-2023-43270

dst-admin v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the userId parameter at /home/playerOperate...

The vulnerability of TP-Link Archer A10’s microprogramming software arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary operating system commands.

The vulnerability of TP-Link Archer A10 router’s microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary operating system commands...

SMShell - Send Commands And Receive Responses Over SMS From Mobile Broadband Capable Computers

PoC for an SMS-based shell. Send commands and receive responses over SMS from mobile broadband capable computers. This tool came as an insipiration during a research on eSIM security implications led by Markus Vervier, presented at Offensivecon 2023 Disclaimer This is not a complete C2 but rather...

Vulnerability of the landing module of the content management system (CMS) for 1C-Bitrix: A website management tool that allows a hacker to execute OS commands on a vulnerable node, gain control over resources, and penetrate the internal network.

Vulnerability of the landing module of the CMS system: Website management is triggered by synchronization errors when using a common resource. Exploiting this vulnerability allows a malicious actor to remotely execute OS commands on a vulnerable node, gain control over resources, and penetrate th...

Super Store Finder 3.7 Remote Command Execution Vulnerability

Vulnerability : Authenticated Arbitrary PHP Code Injection lead to Remote Code Execution Researcher : Etharus Vendor : Joe Iz, https://www.superstorefinder.net/ Demo Url : https://superstorefinder.net/products/superstorefinder/ Version Affected : 3.7 and below Date : 18 September 2023 FOFA Dork :...

Super Store Finder 3.7 Remote Command Execution

Vulnerability : Authenticated Arbitrary PHP Code Injection lead to Remote Code Execution Researcher : Etharus Vendor : Joe Iz, https://www.superstorefinder.net/ Demo Url : https://superstorefinder.net/products/superstorefinder/ Version Affected : 3.7 and below Date : 18 September 2023 FOFA Dork :...