CVE-2020-25494

Xinuos formerly SCO Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook. Recent assessments: gwillcox-r7 at October 15, 2021 3:45pm UTC reported: This is now being exploited in the wild by the Necro...

Huawei Data Communication: A CGI application vulnerability in Some Huawei Products (huawei-sa-20171129-01-httpproxy)

Some open source software used by Huawei does not attempt to address RFC 3875 section 4.1.18 namespace conflicts. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2020-9276

An issue was discovered on D-Link DSL-2640B B2 EU4.01B devices. The function docgi, which processes cgi requests supplied to the device's web servers, is vulnerable to a remotely exploitable stack-based buffer overflow. Unauthenticated exploitation is possible by combining this vulnerability with...

xShock - Shellshock Exploit

xShock ShellShock CVE-2014-6271 This tool exploits shellshock. Written by Hulya Karabag Version 1.0.0 Instagram: Capture the Root Screenshots...

CVE-2019-5990

Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer...

PT-2019-18624

Name of the Vulnerable Software and Affected Versions SonicWall SMA100 affected versions not specified Description The issue is related to an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI, which allows users to test for the presence of a file on the server...

Multiple D-Link routers vulnerable to remote command execution

Overview Multiple D-Link routers are vulnerable to unauthenticated remote command execution. Description Several D-Link routers contain CGI capability that is exposed to users as /applysec.cgi, and dispatched on the device by the binary /www/cgi/ssi. This CGI code contains two flaws: 1. The...

CVE-2017-6900

An issue was discovered in Riello NetMan 204 14-2 and 15-2. The issue is with the login script and wrongpass Python script used for authentication. When calling wrongpass, the variables $VAL0 and $VAL1 should be enclosed in quotes to prevent the potential for Bash command injection. Further to...

blog.techdex.net XSS vulnerability

Open Bug Bounty ID: OBB-679658 Description| Value ---|--- Affected Website:| blog.techdex.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

us.illinois.net XSS vulnerability

Open Bug Bounty ID: OBB-639944 Description| Value ---|--- Affected Website:| us.illinois.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Geutebruck 5.02024 G-Cam/EFD-2250 - simple_loglistjs.cgi Remote Command Execution Exploit

This Metasploit module exploits a an arbitrary command execution vulnerability. The vulnerability exists in the /uapi-cgi/viewer/simpleloglistjs.cgi page and allows an anonymous user to execute arbitrary commands with root privileges. Firmware 'Geutebruck simpleloglistjs.cgi Remote Command...

johnhorse.com XSS vulnerability

Open Bug Bounty ID: OBB-627287 Description| Value ---|--- Affected Website:| johnhorse.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-11714

An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices. This issue is caused by improper session handling on the /cgi/ folder or a /cgi file. If an attacker sends a header of...

cmireb.be XSS vulnerability

Open Bug Bounty ID: OBB-612719 Description| Value ---|--- Affected Website:| cmireb.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

triumphpc.com XSS vulnerability

Open Bug Bounty ID: OBB-601437 Description| Value ---|--- Affected Website:| triumphpc.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

The vulnerability of the cgiHandler function in the Embedthis GoAhead web server allows a hacker to execute arbitrary code.

The vulnerability of the cgiHandler function in the Embedthis GoAhead web server is related to insufficient validation of input data during the processing of HTTP requests for dynamically linked CGI programs. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through...

mail.hakone.com XSS vulnerability

Open Bug Bounty ID: OBB-541584 Description| Value ---|--- Affected Website:| mail.hakone.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

search.southern-charms.com XSS vulnerability

Open Bug Bounty ID: OBB-539876 Description| Value ---|--- Affected Website:| search.southern-charms.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

szkandelous.com XSS vulnerability

Open Bug Bounty ID: OBB-537436 Description| Value ---|--- Affected Website:| szkandelous.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-18025

cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the username field, as demonstrated by a username beginning with "admin|" to use the '|' metacharacter...