CVE-2025-71284

Synway SMG Gateway Management Software is affected by an OS command injection in the RADIUS configuration endpoint /en/9-2radius.php. The radius_address POST parameter (and related fields) is split and interpolated directly into a sed command without sanitization, enabling an unauthenticated remo...

CVE-2025-71284: Improper Neutralization of Special Elements used in an OS Command

Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radiusaddress POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can...

Synway SMG Gateway Management Software 操作系统命令注入漏洞

Synway SMG Gateway Management Software is a gateway management software developed by Synway Corporation. This software has a vulnerability related to operating system command injection. The vulnerability stems from the RADIUS configuration endpoint/en/9-2radius.php, where the radiusaddress POST...

@smg-automotive/auth (>=8.2.3, <=9.0.2-support-next-16.2.1) potentially affected by CVE-2026-40155 via @auth0/nextjs-auth0 (>=4.12.1, <=4.17.1)

@auth0/nextjs-auth0 NPM version =4.12.1, =8.2.3, =9.0.2-support-next-16.2.1 Source cves: CVE-2026-40155 Source advisory: OSV:GHSA-XQ8M-7C5P-C2R6...

@smg-automotive/auth (>=8.2.3, <=9.0.2-support-next-16.2.1) potentially affected by CVE-2026-40155 via @auth0/nextjs-auth0 (>=4.12.1, <=4.17.1)

@auth0/nextjs-auth0 NPM version =4.12.1, =8.2.3, =9.0.2-support-next-16.2.1 Source cves: CVE-2026-40155 Source advisory: SNYK:JS-AUTH0NEXTJSAUTH0-16109571...

CVE-2020-12594

A privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate their privileges on the system and gain full control over the SMG appliance. This affects SMG prior to 10.7.4...

CVE-2020-12595

An information disclosure flaw allows a malicious, authenticated, privileged web UI user to obtain a password for a remote SCP backup server that they might not otherwise be authorized to access. This affects SMG prior to 10.7.4...

CVE-2025-1448

A vulnerability was found in Synway SMG Gateway Management Software up to 20250204. It has been rated as critical. This issue affects some unknown processing of the file 9-12ping.php. The manipulation of the argument retry leads to command injection. The attack may be initiated remotely. The...

@smg-automotive/auth (>=6.8.0-auth0-update-access-token-endpoint.1, <=8.3.0-lschuerch-FED-782-sync-tenant.7) potentially affected by CVE-2025-67716 via @auth0/nextjs-auth0 (>=4.9.0, <=4.12.1)

@auth0/nextjs-auth0 NPM version =4.9.0, =6.8.0-auth0-update-access-token-endpoint.1, =8.3.0-lschuerch-FED-782-sync-tenant.7 Source cves: CVE-2025-67716 Source advisory: SNYK:JS-AUTH0NEXTJSAUTH0-14361679...

@smg-automotive/auth (>=6.8.0-auth0-update-access-token-endpoint.1, <=8.3.0-lschuerch-FED-782-sync-tenant.7) potentially affected by CVE-2025-67716 via @auth0/nextjs-auth0 (>=4.9.0, <=4.12.1)

@auth0/nextjs-auth0 NPM version =4.9.0, =6.8.0-auth0-update-access-token-endpoint.1, =8.3.0-lschuerch-FED-782-sync-tenant.7 Source cves: CVE-2025-67716 Source advisory: OSV:GHSA-MR6F-H57V-RPJ5...

EUVD-2020-4896

Malware in sbrugna...

EUVD-2020-4897

Malware in sbrugna...

EUVD-2025-4756

Malicious code in bioql PyPI...

Malicious code in @zalastax/nolb-_smg (npm)

The package @zalastax/nolb-smg was found to contain malicious code...

CVE-2025-5243

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion. This issue affects Information...

CVE-2025-5243

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion. This issue affects Information...

CVE-2025-5243 Arbitrary File Upload in SMG Software's Information Portal

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion. This issue affects Information...

CVE-2025-5243

CVE-2025-5243 affects SMG Software Information Portal. Affected versions before 13.06.2025 are vulnerable to unrestricted file upload and improper neutralization of special elements in OS command contexts, enabling code injection and potential upload of a web shell leading to code inclusion. The ...

PT-2025-30665

Name of the Vulnerable Software and Affected Versions SMG Software Information Portal versions prior to 13.06.2025 Description The software contains an unrestricted file upload and improper neutralization of special elements used in an OS command vulnerability, potentially leading to code injecti...

CVE-2025-5243: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion. This issue affects Information...