D-Link DAP-X1860 Code Execution Vulnerability

The D-Link DAP-X1860 is a wireless router from China-based AUO D-Link. The D-Link DAP-X1860 suffers from a code execution vulnerability that stems from an application's failure to properly filter special elements of constructed code segments. An attacker could exploit this vulnerability to execut...

D-Link DAP-X1860 XML Parsing DoS Command Execution

The vulnerability of the parsingXMLstasurvey function in the D-Link DAP-X1860 Wi-Fi signal booster software is related to the absence of a firewall around the SSID identifier of the access point, due to the insertion or modification of arguments during implementation. Exploiting this vulnerabilit...

Xiaomi Router Command Injection Vulnerability (CNVD-2025-06295)

Xiaomi router is a series of wireless routers from the Chinese company Xiaomi. Xiaomi Router suffers from a command injection vulnerability that stems from a failure to properly filter constructed command special characters. An attacker could exploit this vulnerability to execute arbitrary comman...

CVE-2023-24479

An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability...

Authentication flaw

An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability...

CVE-2023-24479

Summary: CVE-2023-24479 affects the Yifan YF325 router’s httpd nvram.cgi endpoint. Talos confirms an authentication bypass vulnerability that lets an attacker craft a network request to trigger arbitrary command execution, including the ability to change admin credentials and gain root access. Af...

CVE-2023-24479

An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability...

CVE-2023-24479

An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability...

CVE-2023-24479: Improper Access Control

An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability...

Yifan YF325 Buffer Error Vulnerability

Yifan YF325 is a wireless router from Yifan. A security vulnerability exists in Yifan YF325 v1.020221108. An attacker can exploit this vulnerability to execute arbitrary commands...

Yifan YF325 Authorization Issues Vulnerability

Yifan YF325 is a wireless router from Yifan. An authorization issue vulnerability exists in Yifan YF325 v1.020221108. An attacker can exploit this vulnerability to execute arbitrary commands...

Yifan YF325 httpd nvram.cgi authentication bypass vulnerability

Talos Vulnerability Report TALOS-2023-1762 Yifan YF325 httpd nvram.cgi authentication bypass vulnerability October 11, 2023 CVE Number CVE-2023-24479 SUMMARY An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.020221108. A specially crafted network...

Sangfor Next-Gen Application Firewall Operating System Command Injection Vulnerability

Sangfor Next-Gen Application Firewall Sangfor NGAF is an application firewall from China-based Sangfor. A security vulnerability exists in Sangfor Next-Gen Application Firewall NGAF version 8.0.17, which originates from an operating system command injection vulnerability. The vulnerability can be...

WS_FTP Server Path Restriction Bypass Command Execution

The vulnerability of the WSFTP Server server is related to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability allows an attacker to bypass security restrictions, gain unauthorized read, edit, or delete access to data, and execute arbitrary commands...

wloggui Interface Privilege Escalation Command Execution

The vulnerability of the wloggui interface of the Control Web Panel CWP application formerly CentOS Web Panel is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary commands...

Cisco Emergency Responder Root Privilege Execution

The vulnerability of the Cisco Emergency Responder, a server for managing and monitoring emergency calls, lies in the use of rigidly encoded credentials. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary commands with root privileges...

Dell SmartFabric Storage Software Access Control Vulnerability

Dell SmartFabric Storage Software is a stand-alone storage software solution from Dell USA. Dell SmartFabric Storage Software suffers from an Access Control Error vulnerability that stems from an incorrect access control vulnerability contained in the CLI. An attacker could exploit this...

Dell SmartFabric Storage Software: Operating System Command Injection Vulnerability

Dell SmartFabric Storage Software is a stand-alone storage software solution from Dell USA. Dell SmartFabric Storage Software suffers from an operating system command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the system...

Dell SmartFabric Storage Software: Operating System Command Injection Vulnerability

Dell SmartFabric Storage Software is a stand-alone storage software solution from Dell USA. Dell SmartFabric Storage Software suffers from an operating system command injection vulnerability that can be exploited by an attacker to execute arbitrary commands...

Newsletter Lite < 4.9.3 - Admin+ Command Injection

Description The plugin does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server. 1 Navigate to "Newsletters Configuration History & Emails Configuration"...