CVE-2021-26752

NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.php via the md or ag HTTP GET parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data...

CVE-2008-3561: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in s03.php in Powergap Shopsystem, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the ag parameter...