138 matches found
CVE-2024-58314
CVE-2024-58314 affects Atcom 100M IP Phones firmware v2.7.x.x. An authenticated command-injection vulnerability exists in the web configuration CGI script, allowing execution of arbitrary system commands via the cmd parameter in web_cgi_main.cgi . This enables remote code execution with administr...
EUVD-2007-4130
Malware in sbrugna...
EUVD-2002-0227
Malware in sbrugna...
EUVD-2004-2310
Malware in sbrugna...
EUVD-2018-17457
Malware in sbrugna...
EUVD-2023-33452
Malicious code in bioql PyPI...
EUVD-2022-52663
Malicious code in bioql PyPI...
JSC R7 R7-Office Document Server path traversal vulnerability
JSC R7 R7-Office Document Server is an office software from the Russian company JSC R7. A path traversal vulnerability exists in JSC R7 R7-Office Document Server 20250820 and earlier versions, which stems from incorrect manipulation of the parameter cmd in the file /downloadas/, which could lead ...
CVE-2010-20059 FreeNAS < 0.7.2 rev 5543 exec_raw.php Arbitrary Command Execution
FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command‐execution backdoor in its web interface. The execraw.php script exposes a cmd parameter that is passed directly to the underlying shell without sanitation...
CVE-2010-20059: Improper Neutralization of Special Elements used in an OS Command
FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command‐execution backdoor in its web interface. The execraw.php script exposes a cmd parameter that is passed directly to the underlying shell without sanitation...
D-Link Router Command Injection
The vulnerability of D-Link DI-7300G+ and DI-8200G router microprogramming software lies in the lack of measures taken to neutralize special elements when processing parameters such as flag, cmd, and iface on the mspinfo.htm page. Exploiting this vulnerability allows a remote attacker to execute...
CVE-2013-10048: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 firmware ≤ 2.13 and ≤ 2.14b01, respectively—due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker c...
CVE-2025-51569: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U1406 router's web interface. The /goform/goformgetcmdprocess endpoint fails to sanitize user input in the cmd parameter before reflecting it into a text/html response. This allows unauthenticated attackers to...
libshare-0.0.26.so Heap Buffer Overflow DoS
The vulnerability of the bssetCmd function in the libshare-0.0.26.so library of the LB-LINK router software lies in the failure to take data cleaning measures at the control level when processing the cmd parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary comman...
CVE-2025-45988
Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bsSetCmd function...
CVE-2025-45988
Several LB-LINK (Blink) routers are vulnerable to command injection due to a failure to implement proper data cleaning measures when processing the cmd parameter in the bs_SetCmd function within the libshare-0.0.26.so library. Affected products and versions include BL-WR9000 V2.4.9 , BL-AC2100_AZ...
CVE-2025-45988: Improper Neutralization of Special Elements used in a Command
Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bsSetCmd function...
Teledyne FLIR AX8 Cross-site Scripting Vulnerability
Teledyne FLIR AX8 is a series of thermal surveillance cameras from Teledyne FLIR USA. A cross-site scripting vulnerability exists in Teledyne FLIR AX8 version 1.46.16 and earlier, which stems from a cross-site scripting attack due to the incorrect operation of the parameter cmd in the file...
