20 matches found
CVE-2026-47096
AJA HELO Plus firmware versions before 2.1.7 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is an unsanitized eParamID_SystemName value accepted through the /config?action=set web configuration API. Unauthenticated attackers with network access can inject malicious Jav...
CVE-2026-7620
CVE-2026-7620 affects the WordPress plugin Notification for Telegram (versions up to 3.5.1). The issue is an authorization bypass that allows authenticated attackers with subscriber-level access and above to create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthori...
EUVD-2026-36752
Tenda 5G03 V05.03.02.04 Version 1.0 is vulnerable to Command injection in the function actionsetvolume via the volume parameter...
EUVD-2026-36753
Tenda 5G03 V05.03.02.04 Version 1.0 is vulnerable to Command injection in the function actionsetratmode via the ratMode parameter...
CVE-2026-38061
Tenda 5G03 V05.03.02.04 Version 1.0 is vulnerable to Command injection in the function actionsetvolume via the volume parameter...
CVE-2026-38061
Tenda 5G03 V05.03.02.04 Version 1.0 is vulnerable to Command injection in the function actionsetvolume via the volume parameter...
CVE-2026-38061
The Tenda 5G03 (Version 1.0) running firmware V05.03.02.04 is vulnerable to a Command injection vulnerability. The flaw exists within the action_set_volume() function, specifically through the volume parameter. An attacker exploiting this could execute arbitrary commands on the system. No updated...
CVE-2026-38062
Tenda 5G03 V05.03.02.04 Version 1.0 is vulnerable to Command injection in the function actionsetratmode via the ratMode parameter...
CVE-2026-38061
Tenda 5G03 V05.03.02.04 Version 1.0 is vulnerable to Command injection in the function actionsetvolume via the volume parameter...
CVE-2026-38062
The Tenda 5G03 router, specifically version V05.03.02.04 (Version 1.0) , is vulnerable to a Command injection flaw. The vulnerability exists in the action_set_rat_mode() function, where the ratMode parameter is improperly neutralized, allowing for the execution of arbitrary OS commands. This issu...
CVE-2026-38062
Tenda 5G03 V05.03.02.04 Version 1.0 is vulnerable to Command injection in the function actionsetratmode via the ratMode parameter...
EUVD-2026-18342
A vulnerability was detected in Tenda G103 1.0.0.5. The impacted element is the function actionsetnetsettings of the file gpon.lua of the component Setting Handler. Performing a manipulation of the argument authLoid/authLoidPassword/authPassword/authSerialNo/authType/oltType/usVlanId/usVlanPriori...
CVE-2026-5339 Tenda G103 Setting gpon.lua action_set_net_settings command injection
A vulnerability was detected in Tenda G103 1.0.0.5. The impacted element is the function actionsetnetsettings of the file gpon.lua of the component Setting Handler. Performing a manipulation of the argument authLoid/authLoidPassword/authPassword/authSerialNo/authType/oltType/usVlanId/usVlanPriori...
CVE-2026-5338 Tenda G103 Setting system.lua action_set_system_settings command injection
A security vulnerability has been detected in Tenda G103 1.0.0.5. The affected element is the function actionsetsystemsettings of the file system.lua of the component Setting Handler. Such manipulation of the argument lanIp leads to command injection. The attack may be performed from remote. The...
CVE-2025-6525: Improper Authorization
A vulnerability classified as problematic was found in 70mai 1S up to 20250611. This vulnerability affects unknown code of the file /cgi-bin/Config.cgi?action=set of the component Configuration Handler. The manipulation leads to improper authorization. The attack needs to be approached within the...
libfluid 安全漏洞
libfluid is an Open Networking open source application. A security vulnerability exists in libfluid that stems from the fact that the fluidmsg::ActionSet::unpack routine contains a null pointer dereference vulnerability caused by an unchecked return value...
CVE-2024-44916: Improper Neutralization of Special Elements used in a Command
Vulnerability in adminip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin/ip.php file and could result in arbitrary command execution...
CVE-2019-14707: Undefined Security Weakness
An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The firmware update process is insecure, leading to remote code execution. The attacker can provide arbitrary firmware in a .dat file via a webparam?system&action=set&upgrade URI...
CVE-2019-14703: Cross-Site Request Forgery (CSRF)
A CSRF issue was discovered in webparam?user&action=set¶m=add in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 to create an admin account...
GHSA-CR6J-3JP9-RW65 Apache Struts vulnerable to remote command execution (RCE) due to improper input validation
Apache Struts contains a Remote Code Execution when using results with no namespace and it's upper actions have no or wildcard namespace. The same flaw exists when using a url tag with no value, action set, and it's upper actions have no or wildcard namespace...