Synway SMG Gateway down.php - Arbitrary File Read Detection

There is an arbitrary file reading vulnerability in the down.php file of Synway SMG gateway management software, through which an attacker can download any file from the server. !/usr/bin/env python3 -- coding: utf-8 -- """There is an arbitrary file reading vulnerability in the down.""" import re...

Synway SMG Gateway 9-2radius.php - Remote Command Execution Detection

Synway SMG Gateway Management Software contains a remote command execution vulnerability in 9-2radius.php, where the radiusaddress parameter is passed to a system call without sanitization. This allows unauthenticated attackers to execute arbitrary commands on the server. !/usr/bin/env python3 --...

CVE-2025-71284 Synway SMG Gateway Management Software OS Command Injection via radius_address

Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radiusaddress POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can...

CVE-2025-71284

Synway SMG Gateway Management Software is affected by an OS command injection in the RADIUS configuration endpoint /en/9-2radius.php. The radius_address POST parameter (and related fields) is split and interpolated directly into a sed command without sanitization, enabling an unauthenticated remo...

Synway SMG Gateway Management Software 操作系统命令注入漏洞

Synway SMG Gateway Management Software is a gateway management software developed by Synway Corporation. This software has a vulnerability related to operating system command injection. The vulnerability stems from the RADIUS configuration endpoint/en/9-2radius.php, where the radiusaddress POST...

CVE-2025-71284: Improper Neutralization of Special Elements used in an OS Command

Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radiusaddress POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can...

@smg-automotive/auth (>=8.2.3, <=9.0.2-support-next-16.2.1) potentially affected by CVE-2026-40155 via @auth0/nextjs-auth0 (>=4.12.1, <=4.17.1)

@auth0/nextjs-auth0 NPM version =4.12.1, =8.2.3, =9.0.2-support-next-16.2.1 Source cves: CVE-2026-40155 Source advisory: OSV:GHSA-XQ8M-7C5P-C2R6...

@smg-automotive/auth (>=8.2.3, <=9.0.2-support-next-16.2.1) potentially affected by CVE-2026-40155 via @auth0/nextjs-auth0 (>=4.12.1, <=4.17.1)

@auth0/nextjs-auth0 NPM version =4.12.1, =8.2.3, =9.0.2-support-next-16.2.1 Source cves: CVE-2026-40155 Source advisory: SNYK:JS-AUTH0NEXTJSAUTH0-16109571...

CVE-2020-12594

A privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate their privileges on the system and gain full control over the SMG appliance. This affects SMG prior to 10.7.4...

CVE-2020-12595

An information disclosure flaw allows a malicious, authenticated, privileged web UI user to obtain a password for a remote SCP backup server that they might not otherwise be authorized to access. This affects SMG prior to 10.7.4...

CVE-2025-1448

A vulnerability was found in Synway SMG Gateway Management Software up to 20250204. It has been rated as critical. This issue affects some unknown processing of the file 9-12ping.php. The manipulation of the argument retry leads to command injection. The attack may be initiated remotely. The...

@smg-automotive/auth (>=6.8.0-auth0-update-access-token-endpoint.1, <=8.3.0-lschuerch-FED-782-sync-tenant.7) potentially affected by CVE-2025-67716 via @auth0/nextjs-auth0 (>=4.9.0, <=4.12.1)

@auth0/nextjs-auth0 NPM version =4.9.0, =6.8.0-auth0-update-access-token-endpoint.1, =8.3.0-lschuerch-FED-782-sync-tenant.7 Source cves: CVE-2025-67716 Source advisory: OSV:GHSA-MR6F-H57V-RPJ5...

@smg-automotive/auth (>=6.8.0-auth0-update-access-token-endpoint.1, <=8.3.0-lschuerch-FED-782-sync-tenant.7) potentially affected by CVE-2025-67716 via @auth0/nextjs-auth0 (>=4.9.0, <=4.12.1)

@auth0/nextjs-auth0 NPM version =4.9.0, =6.8.0-auth0-update-access-token-endpoint.1, =8.3.0-lschuerch-FED-782-sync-tenant.7 Source cves: CVE-2025-67716 Source advisory: GHSA-MR6F-H57V-RPJ5...

@smg-automotive/auth (>=6.8.0-auth0-update-access-token-endpoint.1, <=8.3.0-lschuerch-FED-782-sync-tenant.7) potentially affected by CVE-2025-67716 via @auth0/nextjs-auth0 (>=4.9.0, <=4.12.1)

@auth0/nextjs-auth0 NPM version =4.9.0, =6.8.0-auth0-update-access-token-endpoint.1, =8.3.0-lschuerch-FED-782-sync-tenant.7 Source cves: CVE-2025-67716 Source advisory: SNYK:JS-AUTH0NEXTJSAUTH0-14361679...

EUVD-2020-4896

Malware in sbrugna...

EUVD-2020-4897

Malware in sbrugna...

EUVD-2025-4756

Malicious code in bioql PyPI...

Malicious code in @zalastax/nolb-_smg (npm)

The package @zalastax/nolb-smg was found to contain malicious code...

CVE-2025-5243

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion. This issue affects Information...

CVE-2025-5243

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion. This issue affects Information...