CVE-2020-5601

CVE-2020-5601 affects the Chrome Extension for e-Tax Reception System Ver1.0.0.0. The connected sources describe a vulnerability that allows remote attackers to execute arbitrary commands via unspecified vectors, resulting in command execution on the extension context. Multiple feeds (NVD/Red Hat...

The vulnerability in the web interface of the Cisco Prime Infrastructure monitoring and management system allows a malicious actor to execute arbitrary SQL queries.

The vulnerability in the web interface of the Cisco Prime Infrastructure monitoring and management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

PrestaShop Responsive Mega Menu Module RCE / SQLi Vulnerability

The SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:prestashop:prestashop"; ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.144185"...

Online Student Enrollment System 1.0 - Shell Upload

This Metasploit module exploits a cross site request forgery vulnerability in Online Student Enrollment System This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require "net/http" require "uri" requir...

The vulnerability in the modules/serverdensity_device.py of the configuration management system and SaltStack remote execution module allows a perpetrator to gain unauthorized access to confidential data, cause service failures, or compromise data integrity.

The vulnerability in the modules/serverdensitydevice.py module of the Configuration Management system and SaltStack’s remote execution feature is related to a data processing error. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential data, cause service...

Oracle Hospitality Simphony Remote Code Execution (CVE-2018-2636)

A vulnerability exists in Oracle Hospitality Simphony. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CVE-2020-12033

In Rockwell Automation FactoryTalk Services Platform, all versions, the redundancy host service RdcyHost.exe does not validate supplied identifiers, which could allow an unauthenticated, adjacent attacker to execute remote COM objects with elevated privileges...

Command injection

documentsadd.php in Kordil EDMS through 2.2.60rc3 allows Remote Command Execution because .php files can be uploaded to the documents folder...

Student Enrollment 1.0 - Unauthenticated Remote Code Execution

Exploit Title: Student Enrollment 1.0 - Unauthenticated Remote Code Execution Date: 2020-06-22 Exploit Author: Selim Enes 'Enesdex' Karaduman Vendor Homepage: https://www.sourcecodester.com/php/14281/online-student-enrollment-system-using-phpmysqli.html Version: 1.0 Tested on: Windows 10 /...

CVE-2020-14931

A stack-based buffer overflow in DMitry Deepmagic Information Gathering Tool 1.3a might allow remote WHOIS servers to execute arbitrary code via a long line in a response that is mishandled by nicformatbuff...

CVE-2020-14931

A stack-based buffer overflow in DMitry Deepmagic Information Gathering Tool 1.3a might allow remote WHOIS servers to execute arbitrary code via a long line in a response that is mishandled by nicformatbuff...

mversion command injection vulnerability

mversion is an application packaging processor from Mikael Brevik Software Developers in Norway. A command injection vulnerability exists in versions prior to mversion 2.0.0. A remote attacker could exploit the vulnerability to execute code...

Agent Tesla Panel Remote Code Execution Exploit

This Metasploit module exploits a command injection vulnerability within the Agent Tesla control panel, in combination with an SQL injection vulnerability and a PHP object injection vulnerability, to gain remote code execution on affected hosts. Panel versions released prior to September 12, 2018...

CVE-2020-14443

A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter...

CVE-2020-14421

aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen...

Code injection

aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen...

CVE-2020-14421

CVE-2020-14421 affects aaPanel (versions up to 6.6.6 and earlier). An authenticated user can exploit the Script Content box on the Add Cron Job interface to execute arbitrary commands on the server, due to improper handling of cron entries that enables command injection/remote execution. Multiple...

CVE-2020-3294

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, and RV082 Routers could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code on an affected...

CVE-2020-3274

CVE-2020-3274 affects Cisco Small Business RV320/RV325 series and RV016/RV042/RV082 routers. The issue is a command-injection vulnerability in the web-based management interface caused by improper validation of user-supplied input in scripts, allowing an authenticated administrator to execute arb...

TP-LINK Cloud Cameras NCXXX CVE-2020-13224 - Stack Overflow

CVE-2020-13224 TP-LINK Cloud Cameras NCXXX suffer from a DelMultiUser stack overflow vulnerability. Vulnerability title: TP-LINK Cloud Cameras NCXXX DelMultiUser Stack Overflow Author: Pietro Oliva CVE: CVE-2020-13224 Vendor: TP-LINK Product: NC200, NC210, NC220, NC230, NC250, NC260, NC450 Affect...