PT-2026-35570

A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras...

CVE-2026-31255

A command injection vulnerability exists in Tenda AC18 V15.03.05.05multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling of the guestuser parameter allows attackers to execute arbitrary system commands...

Tenda AC18 安全漏洞

The Tenda AC18 is a router produced by the Chinese company Tenda. The Tenda AC18 V15.03.05.05multi version has a security vulnerability. This vulnerability stems from the improper handling of the guestuser parameter in the /goform/SetSambaCfg interface, which may lead to command injection...

Tenda HG3 注入漏洞

The Tenda HG3 is a fiber-optic network terminal wireless router device designed for home broadband access by the Chinese company Tenda. Version 2.0 of the Tenda HG3 has a vulnerability related to command injection. This vulnerability stems from improper handling of the datasize parameter in the...

PT-2026-35378

A vulnerability was found in Tenda F456 1.0.0.5. This impacts the function FromWriteFacMac of the file /goform/WriteFacMac of the component httpd. The manipulation of the argument mac results in command injection. The attack can be executed remotely. The exploit has been made public and could be...

PT-2026-35521

A security flaw has been discovered in Totolink A8000RU 7.1cu.643 b20200521. The impacted element is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sys info results in os command injection. The attack can...

PT-2026-35409

A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. The manipulation of the argument countrystr results in os command injection. The attack may be performed from remote. The exploit is now public and may be used...

Tenda F456 注入漏洞

The Tenda F456 is a wireless router produced by the Chinese company Tenda. Version 1.0.0.5 of the Tenda F456 contains a vulnerability caused by the FromWriteFacMac function in the httpd component or the goform/WriteFacMac file. This vulnerability arises from the handling of the parameter “mac” in...

D-Link DIR-822 注入漏洞

The D-Link DIR-822 is a wireless router produced by D-Link Corporation. The D-Link DIR-822 A101 version has a vulnerability related to command injection. This vulnerability stems from the handling of the parameter “Hostname” in the system function of the udhcpd DHCP service, located in the...

PT-2026-42902

Name of the Vulnerable Software and Affected Versions Edimax EW-7438RPn versions prior to 1.31 Description Remote OS command injection is possible within the webs component. The issue exists in the formWizSurvey function located in the '/goform/formWizSurvey' endpoint. Manipulation of the...

TOTOLINK A8000RU 命令注入漏洞

TOTOLINK A8000RU is a wireless router produced by TOTOLINK, a Chinese company. The TOTOLINK A8000RU 7.1cu.643b20200521 version contains a command injection vulnerability. This vulnerability stems from the function setDmzCfg in the CGI Handler component’s file/cgi-bin/cstecgi.cgi, which processes...

TOTOLINK A8000RU 命令注入漏洞

The TOTOLINK A8000RU is a wireless router produced by TOTOLINK, a Chinese company. The Totolink A8000RU 7.1cu.643b20200521 version has a command injection vulnerability. This vulnerability stems from improper handling of the parameter ttyserver in the setAdvancedInfoShow function within the CGI...

TOTOLINK A8000RU 命令注入漏洞

TOTOLINK A8000RU is a wireless router produced by TOTOLINK, a Chinese company. The TOTOLINK A8000RU 7.1cu.643b20200521 version contains a command injection vulnerability. This vulnerability stems from the function setStorageCfg in the CGI Handler component’s file/cgi-bin/cstecgi.cgi, which...

PT-2026-35452

A vulnerability was detected in Totolink A8000RU 7.1cu.643 b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument tz results in os command injection. The attack can be executed remotely. The...

PT-2026-35525

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643 b20200521. This impacts the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass leads to os command injection. The attack may be initiated...

PT-2026-35571

Name of the Vulnerable Software and Affected Versions Totolink A8000RU version 7.1cu.643 b20200521 Description An OS command injection issue exists in the CGI Handler component. A remote attacker can exploit this by manipulating the wscDisabled argument within the setWiFiWpsStart function of the...

PT-2026-35365

A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerability affects the function formgponConf of the file /boaform/admin/formgponConf. The manipulation of the argument fmgpon loid results in os command injection. It is possible to launch the attack remotely. The exploit has...

📄 node-tesseract-ocr 2.2.1 Command Injection

In node-tesseract-ocr version 2.2.1, a security vulnerability allows OS command injection when attacker-controlled image paths are passed to the OCR function. ================================================================================================================================== | Title...

📄 thumbler 1.1.2 Command Injection

The thumbler package through version 1.1.2 contains a critical command injection vulnerability in the thumbnail function. User-supplied input parameters input, output, time, size are concatenated into a single ffmpeg command string and executed via childprocess.exec without proper sanitization. A...

Aider MCP Server 注入漏洞

Aider MCP Server is an AI coding task unloading and collaboration tool developed by IndyDevDan. There is a vulnerability in Aider MCP Server, which stems from an unknown function in the aideraicode component file src/aidermcpserver/server.py. This function improperly handles the parameter...