openWB 操作系统命令注入漏洞

openWB is an open source application from snaptec. A security vulnerability exists in OpenWB versions 1.6 and 1.7 that stems from the presence of a command injection vulnerability. An attacker exploits this vulnerability to run arbitrary commands by constructing a GET request...

The vulnerability of the corporate VPN application GlobalProtect Agent, related to errors in processing input data, allows a hacker to execute arbitrary commands with elevated privileges.

The vulnerability of the corporate VPN application GlobalProtect Agent is related to errors in processing input data. Exploiting this vulnerability allows an attacker to execute arbitrary commands with elevated privileges...

CVE-2023-30261

Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request...

CVE-2023-30261

OpenWB CVE-2023-30261 affects OpenWB versions 1.6 and 1.7. The vulnerability is a command injection via crafted GET requests that could allow remote attackers to execute arbitrary commands with high impact (per the record: CVSS v3.1 base score 9.8, CRITICAL, network attack vector, no user interac...

MagnusBilling application unauthenticated Remote Command Execution.

A Command Injection vulnerability in MagnusBilling application 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request. A piece of demonstration code is present in lib/icepay/icepay.php, with a call to an exec. The parameter to exec includes the GET paramete...

GHSA-HHQM-F4M4-PQ39 RaspAP raspap-webgui Command Injection vulnerability

Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form...

CVE-2023-30258

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request...

CVE-2023-30260

Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form...

Command injection

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request...

Command injection

Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form...

SPIP password reset serialization vulnerability

Added: 06/23/2023 Background SPIP is a web-based publishing system written in PHP. Problem Mishandling of serialized data in SPIP's password reset form allows remote attackers to execute arbitrary commands. Resolution Upgrade to SPIP 3.2.18, 4.0.10, 4.1.8, 4.2.1 or higher. References...

CVE-2023-30258

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request...

CVE-2023-30260

Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form...

CVE-2023-30260

CVE-2023-30260 affects RaspAP raspap-webgui (versions up to 2.8.8). The root cause is a command injection via a crafted POST to the hostapd settings form, enabling remote execution of arbitrary commands. Documented impact is high (C, I, A) with network attack vector and low privileges. Some conne...

Barracuda Email Security Gateway < 9.2.0.008 Command Injection (CVE-2023-2868)

According to its self-reported version, the Barracuda Email Security Gateway on the remote web server is 9.2.0.008. It is, therefore, affected by a command injection vulnerability in the processing of .tar files that could allow a remote, unauthenticated attacker to execute arbitrary commands wit...

CVE-2023-30258

CVE-2023-30258 affects MagnusBilling magnusbilling 6.x and 7.x with an unauthenticated remote command injection in lib/icepay/icepay.php via the democ parameter. An attacker can craft a request to run arbitrary OS commands, enabling full system compromise as indicated by connected templates and e...

SPIP password reset serialization vulnerability

Added: 06/23/2023 Background SPIP is a web-based publishing system written in PHP. Problem Mishandling of serialized data in SPIP's password reset form allows remote attackers to execute arbitrary commands. Resolution Upgrade to SPIP 3.2.18, 4.0.10, 4.1.8, 4.2.1 or higher. References...

CVE-2022-45287

An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to escalate privileges and perform arbitrary Administrative commands...

Command injection

An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to escalate privileges and perform arbitrary Administrative commands...

SPIP 4.2.1 Remote Code Execution

!/usr/bin/env python3 -- coding: utf-8 -- Exploit Title: SPIP v4.2.1 - Remote Code Execution Unauthenticated Google Dork: inurl:"/spip.php?page=login" Date: 19/06/2023 Exploit Author: nuts7 https://github.com/nuts7/CVE-2023-27372 Vendor Homepage: https://www.spip.net/ Software Link:...