Sql injection

SQL Injection vulnerability in victor cms 1.0 allows attackers to execute arbitrary commands via the post parameter to /post.php in a crafted GET request...

CVE-2023-22789

CVE-2023-22789 affects Aruba InstantOS and ArubaOS 10 CLI. Multiple authenticated command-injection vulnerabilities allow an attacker with valid credentials to execute arbitrary commands as a privileged OS user. Connected sources also describe related CVEs (22787–22791) affecting the same Aruba p...

CVE-2023-22788 Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line Interface

Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2023-22788

CVE-2023-22788 involves multiple authenticated command injection vulnerabilities in the Aruba InstantOS and ArubaOS 10 command line interface. The underlying issue allows an attacker with authenticated access to execute arbitrary commands as a privileged user on the underlying OS. Affected stack ...

Exploit for OS Command Injection in Webmin

CVE-2019-15107 - Webmin RCE 💻🛑 The vulnerability is found in...

CVE-2021-28999

SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1sortby parameter to modules/News/function.adminarticlestab.php...

PT-2023-12131 · Unknown · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions prior to 2.2.16 Description: The issue allows remote attackers to execute arbitrary commands. This is achieved via the m1 sortby parameter to the "modules/News/function.admin articlestab.php" endpoint. Recommendations...

CMS Made Simple SQL注入漏洞

CMS Made Simple CMSMS is an open source content management system CMS by Cmsms team. The system supports role-based permission management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMS Made Simple version...

Victor CMS SQL注入漏洞

Victor CMS is an open source content management system from the individual developer Victor Alagwu in Nigeria. A security vulnerability exists in Victor CMS version 1.0, which stems from the presence of a SQL injection vulnerability that allows an attacker to execute arbitrary commands via a...

CVE-2021-28999

CMS Made Simple suffers an SQL injection in the m1_sortby parameter of modules/News/function.admin_articlestab.php, affecting versions up to 2.2.15. Root cause: improper validation allows remote command execution. Impact: high confidentiality, integrity, and availability (per CVSS) with remote at...

CVE-2023-30013

TOTOLINK X5000R V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter...

CVE-2023-30013

TOTOLINK X5000R V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter...

PT-2023-6552 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R versions V9.1.0u.6118 B20201102 through V9.1.0u.6369 B20230113 Description: The issue concerns a command insertion vulnerability in the setting/setTracerouteCfg component of the TOTOLINK X5000R router's firmware. This...

CVE-2023-30013

TOTOLINK X5000R V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter...

Rocky Linux 9 : emacs (RLSA-2023:2074)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:2074 advisory. - org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name...

CVE-2023-31415

Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of t...

Hotel Druid 跨站脚本漏洞

Hotel Druid is an open source program developed by DigitalDruid.Net for hotel management. A security vulnerability exists in Hotel Druid version 3.0.4, which stems from a stored cross-site scripting XSS vulnerability that allows execution of arbitrary commands...

CVE-2022-30759

In Nokia One-NDS aka Network Directory Server through 20.9, some Sudo permissions can be exploited by some users to escalate to root privileges and execute arbitrary commands...

Command injection

In Nokia One-NDS aka Network Directory Server through 20.9, some Sudo permissions can be exploited by some users to escalate to root privileges and execute arbitrary commands...

GHSA-59HW-J9G6-MFG3 Apache Spark UI vulnerable to Command Injection

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to...