CVE-2020-9413 TIBCO Managed File Transfer reflected XSS vulerability

The MFT Browser file transfer client and MFT Browser admin client components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contain a vulnerability that theoretically allows an attacker to craft an URL that will execute arbitrar...

ATutor 2.2.4 Directory Traversal / Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ATutor 2.2.4 - Directory Traversal / Remote Code Execution, ', 'Description' = %q This module exploits an arbitrary file upload vulnerability...

The vulnerability of the ROMMON mode for Cisco IOS XE operating systems allows a intruder to execute arbitrary commands.

The vulnerability of the ROMMON mode for Cisco IOS XE systems is related to privilege management errors. Exploiting this vulnerability allows an attacker to execute arbitrary commands with root privileges...

OS Command Injection

bunyan is vulnerable to OS command injection. Untrusted user input is not validated and sanitized before being passed to the exec function in /bin/bunyan. This allows a remote attacker to inject and execute arbitrary OS commands in the system...

Bolt CMS 3.7.0 Authenticated Remote Code Execution Exploit

This Metasploit module exploits multiple vulnerabilities in Bolt CMS version 3.7.0 and 3.6.x in order to execute arbitrary commands as the user running Bolt. Valid credentials for a Bolt CMS user are required. This module has been successfully tested against Bolt CMS 3.7.0 running on CentOS 7. Th...

Vanilla Forums SQL Injection (CVE-2013-3527)

An SQL injection vulnerability exists in Vanilla Forums. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...

WordPress Pie Register Plugin SQL Injection (CVE-2018-10969)

A command execution vulnerability exists in WordPress. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2019-16213

Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted string, an attacker could modify the device name of an attached PLC adapter to inject and execute arbitrary commands on the system wi...

Code injection

Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted string, an attacker could modify the device name of an attached PLC adapter to inject and execute arbitrary commands on the system wi...

CVE-2019-16213

Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted string, an attacker could modify the device name of an attached PLC adapter to inject and execute arbitrary commands on the system wi...

Redaxo CMS Addon MyEvents SQL Injection

An SQL injection vulnerability exists in Redaxo. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

OpenEMR fax_dispatch.php Command Injection (CVE-2018-1000019)

A command injection vulnerability exists in openemr openemr 5.0.0. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Trendmicro Email Encryption Gateway SQL Injection (CVE-2018-6230)

An SQL injection vulnerability exists in trendmicro email encryption gateway 5.5. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Command Execution Vulnerability in D-Link DCS-2530

DCS-2530L is a camera from AUO Electronic Equipment Shanghai Co. A command execution vulnerability exists in the D-Link DCS-2530, which can be exploited by an attacker to obtain a cleartext username and password and execute arbitrary commands...

Command Execution Vulnerability in EyouCms System Doctor Plugin

EyouCms system doctor plugin is a user-friendly diagnostic system, repair their own difficulties, and some sql operation functions of the plugin. EyouCms System Doctor plugin has a command execution vulnerability that can be exploited by attackers to execute arbitrary SQL commands...

CVE-2020-14950

aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request start, stop, or restart to the setting menu of Sotfware Store...

ZenTao Pro 8.8.2 Remote Code Execution

This module exploits a command injection vulnerability in ZenTao Pro 8.8.2 and earlier versions in order to execute arbitrary commands with SYSTEM privileges. The module first attempts to authenticate to the ZenTao dashboard. It then tries to execute the payload by submitting fake repositories vi...

Dolibarr SQL Injection Vulnerability (CNVD-2021-24259)

Dolibarr ERP/CRM is an open source software/freeware for small and medium-sized businesses, organizations or freelancers. It includes different features such as Enterprise Resource Planning ERP and Customer Relationship Management CRM, as well as applications for other different activities. A SQL...

CVE-2020-14443

A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter...

CVE-2020-13640

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. No 7.x versions are affected...