CVE-2024-22067: Improper Access Control

ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker may exploit the vulnerability to execute arbitrary commands...

CVE-2024-50919

Jpress, a Java-based blogging platform, versions prior to v5.1.1 are vulnerable to an arbitrary file upload vulnerability on the Windows platform . This flaw allows an attacker to construct non-standard file formats, such as .jsp , which can lead to arbitrary command execution . To mitigate this ...

SmartFabric OS10 Privilege Escalation

The vulnerability of the SmartFabric OS10 network operating system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

PT-2025-13830

Name of the Vulnerable Software and Affected Versions Netgear WNR854T version 1.5.2 Description The issue concerns a command injection vulnerability in the UPNP service, specifically in the addmap exec function. This function parses the NewInternalClient parameter of the "AddPortMapping" SOAPActi...

PT-2025-13829

Name of the Vulnerable Software and Affected Versions Netgear WNR854T version 1.5.2 Description The issue allows for arbitrary command execution in cmd.cgi, enabling the execution of system commands via the web interface. Recommendations For Netgear WNR854T version 1.5.2, consider disabling acces...

Tenda G3 formSetDebugCfg function command injection vulnerability

Tenda G3 is a Qos Vpn router from Tenda China. Tenda G3 suffers from a command injection vulnerability, which stems from the formSetDebugCfg function failing to properly filter constructor command special characters, commands, etc. The vulnerability can be exploited to execute arbitrary commands...

Tenda G3 formSetUSBPartitionUmount function command injection vulnerability

Tenda G3 is a Qos Vpn router from Tenda China. Tenda G3 suffers from a command injection vulnerability, which stems from the formSetUSBPartitionUmount function failing to properly filter constructor command special characters, commands, etc. The vulnerability can be exploited to execute arbitrary...

D-Link DSL6740C OS Command Injection Vulnerability (CNVD-2024-45428)

The D-Link DSL6740C is a wireless VDSL router from China-based AUO D-Link. The D-Link DSL6740C suffers from an operating system command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the system...

D-Link Router Command Injection

The vulnerability of D-Link DSL-2640U and DSL-2540U router microprogramming systems lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands using metasymbols within the...

CVE-2024-52505 matrix-appservice-irc allows IRC Command injection in provisioning API

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in...

TOTOLINK X18 Command Injection Vulnerability

TOTOLINK X18 is a mesh router system from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X18 version 9.1.0cu.2024B20220329, which stems from the enable parameter in the /cgi-bin/cstecgi.cgi page failing to correctly filter constructed command special...

Tenda G3 命令注入漏洞

Tenda G3 is a Qos Vpn router from Tenda China. Tenda G3 suffers from a command injection vulnerability, which stems from the formSetUSBPartitionUmount function failing to properly filter constructor command special characters, commands, etc. The vulnerability can be exploited to execute arbitrary...

D-Link DI-8003 Command Injection Vulnerability

The D-Link DI-8003 is a wireless router from China-based AUO D-Link. A command injection vulnerability exists in the D-Link DI-8003 version 16.07.16A1, which stems from the parameter path in the file /upgradefilter.asp failing to correctly filter construct command special characters, commands, et...

Juniper Networks Junos Space Command Execution

The vulnerability of the Juniper Networks Junos Space network resource management platform lies in the lack of measures taken to sanitize input data at the control level. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending specially crafted requests...

CyberPanel upgrademysqlstatus Arbitrary Command Execution

import httpx import sys def getCSRFtokenclient: resp = client.get"/" return resp.cookies'csrftoken' def pwnclient, CSRFtoken, cmd: headers = "X-CSRFToken": CSRFtoken, "Content-Type":"application/json", "Referer": strclient.baseurl payload = '"statusfile":"/dev/null; %s; ","csrftoken":"%s"' % cmd,...

TOTOLINK X18 命令注入漏洞

TOTOLINK X18 is a mesh router system from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X18 version 9.1.0cu.2024B20220329, which stems from the enable parameter in the /cgi-bin/cstecgi.cgi page failing to correctly filter constructed command special...

NETGEAR XR300 wiz_dyn.cgi component command injection vulnerability

The NETGEAR XR300 is a wireless router from NETGEAR. NETGEAR XR300 version v1.0.3.78 suffers from a command injection vulnerability that stems from the systemname parameter in the wizdyn.cgi component failing to properly filter constructed command special characters, commands, and so on. An...

NETGEAR R7000P Command Injection Vulnerability

The NETGEAR R7000P is a wireless router from NETGEAR. A command injection vulnerability exists in NETGEAR R7000P v1.3.3.154, which stems from the devicename2 parameter in the operationmode.cgi component failing to correctly filter constructed command special characters, commands, and so on. An...

NETGEAR XR300 genie_dyn.cgi component command injection vulnerability

The NETGEAR XR300 is a wireless router from NETGEAR. A command injection vulnerability exists in NETGEAR XR300 v1.0.3.78, which stems from the systemname parameter in the geniedyn.cgi component failing to properly filter constructed command special characters, commands, and so on. An attacker cou...

Tenda AC6 Command Injection Vulnerability (CNVD-2024-44861)

The Tenda AC6 is a wireless router from the Chinese company Tenda. A command injection vulnerability exists in Tenda AC6 version 15.03.05.19, which stems from the parameter The failing to properly filter constructed command special characters, commands, etc. The vulnerability can be exploited to...