Tenda W18E command injection vulnerability

The Tenda W18E is a wireless router from the Chinese company Tenda. Tenda W18E suffers from a command injection vulnerability, which originates from the hostName parameter in the formSetNetCheckTools function failing to correctly filter the constructor command special characters, commands, etc...

CVE-2023-5043: Improper Input Validation

Ingress nginx annotation injection causes arbitrary command execution...

Ingress NGINX Controller Injection Vulnerability

Ingress NGINX Controller is a Kubernetes open source entry controller for Kubernetes. A security vulnerability exists in Ingress NGINX Controller. An attacker can exploit this vulnerability to execute arbitrary commands...

CVE-2023-46102: Use of Hard-coded Credentials

The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI device. The protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric...

SeaCMS Security Vulnerability

SeaCMS is a free and open source web content management system written in PHP. The system is primarily designed to be used to manage video-on-demand resources. A security vulnerability exists in SeaCMS version v.12.9. An attacker can exploit this vulnerability to execute arbitrary commands via th...

NetModule Router Software Operating System Command Injection Vulnerability

NetModule Router Software is a router from NetModule. A security vulnerability exists in NetModule Router Software NRSW versions 4.6.x prior to 4.6.0.106 and 4.8.x prior to 4.8.0.101, which originates from the construction of operating system commands using unpurified user input, and which can be...

CVE-2023-40145

In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device...

CVE-2023-40145

CVE-2023-40145 is an OS Command Injection in Weintek cMT3000 HMI Web CGI (cgi-bin area). The vulnerability allows an anonymous attacker, after login, to execute arbitrary commands on affected devices. The issue is classified under CWE-78 (OS Command Injection) and is part of a pair of flaws affec...

CVE-2023-30131

CVE-2023-30131 affects IXP EasyInstall 6.6.14884.0. The issue allows attackers to run arbitrary commands and escalate privileges via unauthenticated API calls, with the NVD entry noting a high-impact remote code execution potential (CVSS v3.1: 9.8). Connected sources consistently describe command...

CVE-2023-30131: Improper Control of Generation of Code

An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts via unauthenticated API calls...

FreshTomato Command Execution Vulnerability

FreshTomato is a Linux-based open source firmware from FreshTomato Open Source. The firmware provides a variety of features for Broadcom-based routers. A command execution vulnerability exists in FreshTomato version 2023.3, which stems from the application failing to properly filter construct...

PT-2023-22551 · Unknown · Ixp Easyinstall

Name of the Vulnerable Software and Affected Versions: IXP EasyInstall version 6.6.14884.0 Description: An issue in IXP EasyInstall allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts via unauthenticated API calls. Recommendations: For IXP...

Debian RaspAP Arbitrary Command Execution

The vulnerability of the software for creating wireless routers based on Debian RaspAP is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially crafted POST request with t...

CVE-2022-22375: Unrestricted Upload of File with Dangerous Type

IBM Security Verify Privilege On-Premises 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 221681...

CVE-2023-3991

An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability...

Command injection

An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2023-3991

CVE-2023-3991 is an OS command injection vulnerability in FreshTomato 2023.3, affecting the httpd iperfrun.cgi functionality. A specially crafted HTTP request can lead to arbitrary command execution with network access and no privileges required. Impact is described as total compromise of the aff...

CVE-2023-3991 OS command injection vulnerability in FreshTomato 2023.3

An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2023-45158

An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging not the default configuration, a crafted web request may execute an arbitrary OS command on the web server using the product...

CVE-2023-3991: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability...