Exploit for OS Command Injection in Php

PHP-CGI Injector 🚀 CVE-2024-4577 & CVE-2024-8926 Exploit To...

[SECURITY] Fedora 42 Update: man2html-1.6-39.g.fc42

man2html is a man page to HTML converter. This package contains CGI scripts that allow you to view, browse, and search man pages using a web server...

OESA-2025-1263 ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains ...

OESA-2025-1264 ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains ...

PT-2025-19322

Name of the Vulnerable Software and Affected Versions Synology Router Manager SRM affected versions not specified FileStation affected versions not specified Description A security issue exists in Synology Router Manager SRM related to insufficient protection of service data. Remote attackers may...

PT-2025-10748

Name of the Vulnerable Software and Affected Versions Claro A7600-A1 RNR4-A72T-2x16 v2110403 CLA 32 160817 Description A problem has been found in the Ping6 Diagnóstico component, specifically in the /form2pingv6.cgi file. The issue affects some unknown functionality of this file. The manipulatio...

CVE-2025-2191: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in Claro A7600-A1 RNR4-A72T-2x16v2110403CLA32160817. Affected by this issue is some unknown functionality of the file /form2pingv6.cgi of the component Ping6 Diagnóstico. The manipulation of the argument ip6addr with the input...

[SECURITY] [DLA 4082-1] ruby2.7 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4082-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès March 10, 2025 https://wiki.debian.org/LTS -...

PT-2025-10597

ParsedReport CompletenessMedium 10-03-2025 GreyNoise Detects Mass Exploitation of Critical PHP-CGI Vulnerability CVE-2024-4577, Signaling Broad Campaign https://www.greynoise.io/blog/mass-exploitation-critical-php-cgi-vulnerability-cve-2024-457 Report completeness: Medium Threats: Cobalt strike...

CVE-2025-2097

CVE-2025-2097 affects TOTOLINK EX1800T (firmware 9.1.0cu.2112_B20220316). The vulnerability lies in the function setRptWizardCfg in /cgi-bin/cstecgi.cgi where manipulating the loginpass parameter causes a stack-based buffer overflow. Reports indicate the attack can be initiated remotely and that ...

CVE-2025-2095

A vulnerability classified as critical has been found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to initiate the attack remotely. The exploit has...

Denial Of Service (DoS)

CGI is vulnerable to Denial of Service DoS. The vulnerability is due to the lack of a length limit on raw cookie values in the CGI::Cookie.parse method, allowing excessively large cookies to consume system resources...

PHP-CGI RCE Flaw Exploited in Attacks on Japan's Tech, Telecom, and E-Commerce Sectors

Threat actors of unknown provenance have been attributed to a malicious campaign predominantly targeting organizations in Japan since January 2025. "The attacker has exploited the vulnerability CVE-2024-4577, a remote code execution RCE flaw in the PHP-CGI implementation of PHP on Windows, to gai...

[SECURITY] Fedora 41 Update: man2html-1.6-39.g.fc41

man2html is a man page to HTML converter. This package contains CGI scripts that allow you to view, browse, and search man pages using a web server...

PT-2025-10125

Name of the Vulnerable Software and Affected Versions TOTOLINK EX1800T version 9.1.0cu.2112 B20220316 Description A critical vulnerability was found in TOTOLINK EX1800T, affecting the function setRebootScheCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the arguments mode, week, minute,...

PT-2025-10124

Name of the Vulnerable Software and Affected Versions TOTOLINK EX1800T version 9.1.0cu.2112 B20220316 Description A critical vulnerability has been found in TOTOLINK EX1800T. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os...

CVE-2025-2097: Stack-based Buffer Overflow

A vulnerability, which was classified as critical, has been found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. This issue affects the function setRptWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument loginpass leads to stack-based buffer overflow. The attack may be initiat...

PT-2025-10123

Name of the Vulnerable Software and Affected Versions TOTOLINK EX1800T version 9.1.0cu.2112 B20220316 Description A critical issue was found in the setWiFiExtenderConfig function of the /cgi-bin/cstecgi.cgi file. The manipulation of the apcliKey/key argument leads to os command injection. This...

CVE-2025-2094: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. It has been rated as critical. Affected by this issue is the function setWiFiExtenderConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument apcliKey/key leads to os command injection. The attack may be launche...

CVE-2025-2096: Improper Neutralization of Special Elements used in an OS Command

A vulnerability classified as critical was found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. This vulnerability affects the function setRebootScheCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument mode/week/minute/recHour leads to os command injection. The attack can be initiat...