CVE-2024-50919: Improper Control of Generation of Code

Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary command execution...

CVE-2024-50919

Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary command execution...

CVE-2024-50919

Jpress, a Java-based blogging platform, versions prior to v5.1.1 are vulnerable to an arbitrary file upload vulnerability on the Windows platform . This flaw allows an attacker to construct non-standard file formats, such as .jsp , which can lead to arbitrary command execution . To mitigate this ...

CVE-2024-22067: Improper Access Control

ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker may exploit the vulnerability to execute arbitrary commands...

SmartFabric OS10 Privilege Escalation

The vulnerability of the SmartFabric OS10 network operating system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

PT-2025-13829

Name of the Vulnerable Software and Affected Versions Netgear WNR854T version 1.5.2 Description The issue allows for arbitrary command execution in cmd.cgi, enabling the execution of system commands via the web interface. Recommendations For Netgear WNR854T version 1.5.2, consider disabling acces...

PT-2025-13830

Name of the Vulnerable Software and Affected Versions Netgear WNR854T version 1.5.2 Description The issue concerns a command injection vulnerability in the UPNP service, specifically in the addmap exec function. This function parses the NewInternalClient parameter of the "AddPortMapping" SOAPActi...

D-Link DSL6740C OS Command Injection Vulnerability (CNVD-2024-45428)

The D-Link DSL6740C is a wireless VDSL router from China-based AUO D-Link. The D-Link DSL6740C suffers from an operating system command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the system...

Tenda G3 formSetUSBPartitionUmount function command injection vulnerability

Tenda G3 is a Qos Vpn router from Tenda China. Tenda G3 suffers from a command injection vulnerability, which stems from the formSetUSBPartitionUmount function failing to properly filter constructor command special characters, commands, etc. The vulnerability can be exploited to execute arbitrary...

Tenda G3 formSetDebugCfg function command injection vulnerability

Tenda G3 is a Qos Vpn router from Tenda China. Tenda G3 suffers from a command injection vulnerability, which stems from the formSetDebugCfg function failing to properly filter constructor command special characters, commands, etc. The vulnerability can be exploited to execute arbitrary commands...

D-Link Router Command Injection

The vulnerability of D-Link DSL-2640U and DSL-2540U router microprogramming systems lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands using metasymbols within the...

CVE-2024-52505 matrix-appservice-irc allows IRC Command injection in provisioning API

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in...

D-Link DI-8003 Command Injection Vulnerability

The D-Link DI-8003 is a wireless router from China-based AUO D-Link. A command injection vulnerability exists in the D-Link DI-8003 version 16.07.16A1, which stems from the parameter path in the file /upgradefilter.asp failing to correctly filter construct command special characters, commands, et...

Tenda G3 command injection vulnerability

Tenda G3 is a Qos Vpn router from Tenda China. Tenda G3 suffers from a command injection vulnerability, which stems from the formSetUSBPartitionUmount function failing to properly filter constructor command special characters, commands, etc. The vulnerability can be exploited to execute arbitrary...

TOTOLINK X18 Command Injection Vulnerability

TOTOLINK X18 is a mesh router system from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X18 version 9.1.0cu.2024B20220329, which stems from the enable parameter in the /cgi-bin/cstecgi.cgi page failing to correctly filter constructed command special...

Juniper Networks Junos Space Command Execution

The vulnerability of the Juniper Networks Junos Space network resource management platform lies in the lack of measures taken to sanitize input data at the control level. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending specially crafted requests...

NETGEAR XR300 genie_dyn.cgi component command injection vulnerability

The NETGEAR XR300 is a wireless router from NETGEAR. A command injection vulnerability exists in NETGEAR XR300 v1.0.3.78, which stems from the systemname parameter in the geniedyn.cgi component failing to properly filter constructed command special characters, commands, and so on. An attacker cou...

Tenda AC6 Command Injection Vulnerability (CNVD-2024-44861)

The Tenda AC6 is a wireless router from the Chinese company Tenda. A command injection vulnerability exists in Tenda AC6 version 15.03.05.19, which stems from the parameter The failing to properly filter constructed command special characters, commands, etc. The vulnerability can be exploited to...

NETGEAR R8500 genie_fix2.cgi Component Command Injection Vulnerability

The NETGEAR R8500 is a wireless router from NETGEAR. A command injection vulnerability exists in the NETGEAR R8500 v1.0.2.160, which stems from the wangateway parameter in the geniefix2.cgi component failing to correctly filter constructed command special characters, commands, and so on. An...

NETGEAR R8500 bsw_fix.cgi Component Command Injection Vulnerability

The NETGEAR R8500 is a wireless router from NETGEAR. A command injection vulnerability exists in the NETGEAR R8500 v1.0.2.160, which stems from the wangateway parameter in the bswfix.cgi component failing to correctly filter constructed command special characters, commands, and so on. An attacker...