CVE-2023-33273

An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the WGET check function is vulnerable to OS command injection blind...

CVE-2023-33270

An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the Curl check function is vulnerable to OS command injection blind...

Dataprobe OS Command Injection Vulnerability

Dataprobe is a series of intelligent power switch and management products from Dataprobe, Inc. in the United States. Dataprobe iBoot PDU 1.43.03312023 and earlier versions suffer from an operating system command injection vulnerability that stems from an attack that is prone to command injection...

PT-2023-21974 · Zscaler · Client Connector

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A URL parameter during the login flow was vulnerable to injection, allowing an attacker to insert a malicious domain. This would redirect the user after authentication and send the...

OTCMS 路径遍历漏洞

OTCMS Net Titanium CMS is a content management system CMS for article-based websites. A path traversal vulnerability exists in OTCMS versions prior to 6.62, which stems from path traversal due to incorrect manipulation of the parameter url...

CVE-2023-2159

The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmpbypass GET parameter in the URL equal to the md5-hashed homeurl in the default setting allows users to visit a site placed in maintenance mode th...

Weaver E-Office 安全漏洞

Weaver E-Office is a collaborative office system from China's PanWei Technologies Weaver. A security vulnerability exists in Weaver E-Office version 9.5 and earlier versions, which is caused by an incorrect operation of the parameter url that results in absolute path traversal...

PT-2023-13001 · Fortinet · Fortianalyzer +1

Name of the Vulnerable Software and Affected Versions: FortiAnalyzer versions prior to 7.2.1 FortiAnalyzer versions prior to 7.0.4 FortiAnalyzer versions prior to 6.4.8 Description: The issue is related to an improper neutralization of input during web page generation, which may allow a remote...

SUSE CVE-2015-7873

The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter...

Inline SVG 跨站脚本漏洞

Inline SVG is a library from the personal developer James Martin. SVG documents are styled for use on the Web using CSS by adding classes to the document and embedding them in HTML. A cross-site scripting vulnerability exists in Inline SVG that stems from unknown functionality in the file...

Printer 命令注入漏洞

Printer is a tool open-sourced by Exciting. Explore IoT printing possibilities. Printer suffers from a command injection vulnerability that stems from incorrect manipulation of the parameter URL leading to command injection...

CVE-2022-31208

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The webserver contains an endpoint that can execute arbitrary commands by manipulating the cmdstring URL parameter...

The vulnerability of the Microprogrammed Software for Infiray IRAY-A8Z3 thermal imagers arises from incorrect code generation control, allowing a intruder to execute arbitrary code.

The vulnerability of the Infiray IRAY-A8Z3 thermal imager’s microprogramming software is related to incorrect handling of the code generation process. Exploiting this vulnerability could allow an intruder to execute arbitrary code using the cmdstring URL parameter...

迅易科技 74cms 安全漏洞

Xunyi Technology 74cms is a PHP and MySQL based online recruitment system from China Xunyi Technology Company. A security vulnerability exists in 74cmsSE v3.4.1, which was discovered via the $url parameter in indexcontrollerDownload.php. 74cmsSE v3.4.1 contains an arbitrary file read vulnerabilit...

CVE-2022-25452

Tenda AC6 v15.03.05.09multi was discovered to contain a stack overflow via the URLs parameter in the saveParentControlInfo function...

CVE-2022-25433

Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the urls parameter in the saveparentcontrolinfo function...

CVE-2022-23397

The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. NOTE: the vendor disputes this because the ado.im reference has "no...

CVE-2021-25096

The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL...

Totolink X5000R 缓冲区错误漏洞

The TotoLink X5000R is a router from China's Gion Electronics TotoLink. The Totolink X5000R v9.1.0u.6118B20201102 suffers from a buffer error vulnerability that allows an attacker to cause a denial of service DoS via the url parameter...

D-Link Di-7200G 命令注入漏洞

D-Link Di-7200G is a gigabit enterprise router from D-Link, China.D-Link DI-7200GV2.E1 v21.04.09E1 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the url parameter...