CVE-2021-31324

CentOS Web Panel’s unprivileged User Portal is affected by a Command Injection vulnerability (CVE-2021-31324). The Nuclei templates describe exploitation via the idsession parameter, allowing unauthenticated attackers to execute arbitrary OS commands with root privileges, leading to full server c...

CentOS Web Panel SQL Injection Vulnerability

CentOS Web Panel CWP is a free web hosting control panel from the Control Web Panel community. A SQL injection vulnerability exists in CentOS Web Panel that allows unprivileged users to attack via the idsession, an HTTP POST parameter...

CVE-2021-31324: Improper Neutralization of Special Elements used in an OS Command

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution...

PT-2021-19237 · Unknown · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel affected versions not specified Description: The issue affects the unprivileged user portal part of CentOS Web Panel, where a SQL Injection is possible via the idsession HTTP POST parameter. Recommendations: At the moment,...

CVE-2021-31316: Improper Neutralization of Special Elements used in an SQL Command

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter...

PT-2021-19242 · Unknown · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel affected versions not specified Description: The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection issue, which can lead to root Remote Code Execution. Recommendations: At the moment, there ...

CentOS Web Panel operating system command injection vulnerability

CentOS Web Panel CWP is a free web hosting control panel from the Control Web Panel community. A security vulnerability exists in CentOS Web Panel that originates in the Unprivileged User Portal section that is affected by a command injection vulnerability that can be exploited by an attacker to...

Sipwise C5 NGCP CSC - 'Multiple' Persistent Cross-Site Scripting (XSS)

Exploit Title: Sipwise C5 NGCP CSC - 'Multiple' Stored/Reflected Cross-Site Scripting XSS Date: 13.04.2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.sipwise.com Sipwise C5 NGCP CSC Multiple Stored/Reflected XSS Vulnerabilities Vendor: Sipwise GmbH Product web page:...

NETGEAR JGS516PE/GS116Ev2 Cross-Site Scripting Vulnerability

The NETGEAR JGS516PE/GS116Ev2 is a 16-port Gigabit Smart Managed Plus switch. A cross-site scripting vulnerability exists in the management web panel of the NETGEAR JGS516PE/GS116Ev2 version 2.6.0.43. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the...

CVE-2020-35230

Multiple integer overflow parameters were found in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices. Most of the integer parameters sent through the web server can be abused to cause a denial of service attack...

Cross site scripting

A cross-site scripting XSS vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote attackers to inject arbitrary web script or HTML via the language parameter...

CVE-2020-35228

CVE-2020-35228 affects NETGEAR JGS516PE/GS116Ev2 switches running v2.6.0.43, where the administration web panel is vulnerable to cross-site scripting via the language parameter. The issue is described as an XSS in the management web interface that could allow attackers to inject arbitrary script/...

CVE-2020-35227: Buffer Copy without Checking Size of Input

A buffer overflow vulnerability in the access control section on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices in the administration web panel allows an attacker to inject IP addresses into the whitelist via the checkedList parameter to the delete command...

CVE-2020-35228: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote attackers to inject arbitrary web script or HTML via the language parameter...

PT-2021-2404

Name of the Vulnerable Software and Affected Versions: NETGEAR JGS516PE/GS116Ev2 version 2.6.0.43 Description: A buffer overflow vulnerability in the access control section of the administration web panel allows an attacker to inject IP addresses into the whitelist via the checkedList parameter t...

PT-2021-2433

Name of the Vulnerable Software and Affected Versions: NETGEAR JGS516PE/GS116Ev2 version 2.6.0.43 Description: A cross-site scripting XSS vulnerability in the administration web panel allows remote attackers to inject arbitrary web script or HTML via the language parameter, also referred to as...

CVE-2020-17503

The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in splitcardcmd.php in which the http parameter "lockin...

Backdoor in Zyxel Firewalls and Gateways

This is bad: More than 100,000 Zyxel firewalls, VPN gateways, and access point controllers contain a hardcoded admin-level backdoor account that can grant attackers root access to devices via either the SSH interface or the web administration panel. … Installing patches removes the backdoor...

Fastweb FASTGate Cross-Site Request Forgery Vulnerability (CNVD-2020-67310)

Fastweb FASTGate is a modem from Fastweb Italy. A cross-site request forgery vulnerability exists in Fastweb FASTGate GPON FGA2130FWB version 2020-05-26 and prior versions that allows CSRF to manage web panels through the router, which could be exploited by an attacker to be able to perform...

CVE-2020-13620

Fastweb FASTGate GPON FGA2130FWB devices through 2020-05-26 allow CSRF via the router administration web panel, leading to an attacker's ability to perform administrative actions such as modifying the configuration...