1197 matches found
Gryphon Tower 跨站脚本漏洞
A cross-site scripting vulnerability exists in Gryphon Tower, a wireless router from Gryphon. The vulnerability stems from a lack of user-supplied data and output data validation filtering in the url parameter of cgi-bin/luci/siteaccess/, which can be exploited to execute client-side JavaScript...
Cross site scripting
GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/routercgi?action=scanwifi XSS when an attacker creates an SSID with an XSS payload as the name...
CVE-2021-44148
GL.iNet GL-AR150 2.x before 3.x devices configured as repeaters are affected by a cross‑site scripting (XSS) vulnerability in cgi-bin/router_cgi?action=scanwifi. An attacker can embed an XSS payload in the SSID name, triggering XSS. This is documented in CVE-2021-44148 (NVD/NVD-derived descriptio...
Exploit for Path Traversal in Apache Http_Server
Apache 2.4.50 - Path Traversal or Remote Code Execution CVE-20...
Exploit for Path Traversal in Apache Http_Server
Apache 2.4.49 - Path Traversal or Remote Code Execution cve-20...
Dlink DSL2750U - (Reboot) Command Injection Exploit
Exploit Title: Dlink DSL2750U - 'Reboot' Command Injection Exploit Author: Mohammed Hadi HadiMed Vendor Homepage: https://me.dlink.com/consumer Software Link: https://dlinkmea.com/index.php/product/details?det=c0lvN0JoeVVhSXh4TVhjTnd1OUpUUT09 Version: ME1.16 Tested on: firmware...
VulnCheck KEV: CVE-2020-25494
Xinuos formerly SCO Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook...
IPFire 2.25 Core Update 156 and Prior pakfire.cgi Authenticated RCE
This module exploits an authenticated command injection vulnerability in the /cgi-bin/pakfire.cgi web page of IPFire devices running versions 2.25 Core Update 156 and prior to execute arbitrary code as the root user. Module Options msf use exploit/linux/http/ipfire/pakfireexec msf...
The vulnerability of QTS web servers for operating systems and QNAP network storage devices allows a hacker to execute arbitrary code.
The vulnerability of the QTS web server for operating systems and QNAP network storage devices is related to insufficient protection of operational data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code via CGI scripts from the /mnt/HDAROOT/home/httpd/cgi-bin...
CVE-2020-24285
INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cgiServer.exx...
Intelbras TIP 200 信息泄露漏洞
Intelbras TIP 200 is an IP phone product from Intelbras, Brazil. The device is an IP terminal that supports up to two SIP accounts and has features such as high voice quality HD Voice, LCD 2x15, and power PoE Power over Ethernet. An information disclosure vulnerability exists in INTELBRAS TELEFON...
PT-2021-16521 · Skyworth Digital Technology · Rn510
Name of the Vulnerable Software and Affected Versions: Skyworth Digital Technology RN510 version 3.1.0.4 Description: The issue is related to an incorrect access control vulnerability in the /cgi-bin/test version.asp endpoint. If Wi-Fi is connected and an unauthenticated user visits a specific UR...
CVE-2021-27403
Askey RTF8115VW BRSVg11.11RTFTEF001V6.54V014 devices allow cgi-bin/teaccesorouter.cgi curWebPage XSS...
CVE-2021-27403
Askey RTF8115VW BRSVg11.11RTFTEF001V6.54V014 devices allow cgi-bin/teaccesorouter.cgi curWebPage XSS...
CVE-2021-27403
CVE-2021-27403 affects Asus Askey routers: specifically the RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 family. The vulnerability is a cross-site scripting (XSS) in the web interface, exposed via cgi-bin/te_acceso_router.cgi with curWebPage context. Public descriptions consistently state that th...
Design/Logic Flaw
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interfac...
Design/Logic Flaw
Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel which will require a physical reset to restore administrative control via Randomnum=99AC8CEC6E845B28&mode=1 in a POST request to the cgi-bin/setfactory URI...
CVE-2020-25494
Xinuos formerly SCO Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook...
Code injection
Xinuos formerly SCO Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook...
