CVE-2026-75123 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...

CVE-2026-75123 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...

CVE-2026-75123

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test_post handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization, allowing a remote attacker...

EUVD-2026-67783

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...

CVE-2026-75122 PLANET GS-4210-16P2S V3 Command Injection via httpuploadcert.cgi

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A...

CVE-2026-75122 PLANET GS-4210-16P2S V3 Command Injection via httpuploadcert.cgi

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A...

CVE-2026-75122

PLANET GS-4210-16P2S firmware before 3.441b260626 is affected by an authenticated OS command injection in /cgi-bin/httpuploadcert.cgi . The certificate password field in a certificate upload request is passed to a shell command without sanitization of shell metacharacters, allowing a remote attac...

EUVD-2026-67782

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A remote...

EUVD-2026-67781

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...

CVE-2026-75121

PLANET GS-4210-16P2S managed switches with firmware prior to 3.441b260626 are affected by an authenticated OS command injection in /cgi-bin/dispatcher.cgi. The web_vlan_membership_edit_dialog_post handler incorporates the memberTags POST parameter directly into a shell command without sanitizatio...

CVE-2026-75121 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...

CVE-2026-75121 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...

CVE-2026-33606

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...

ALPINE-CVE-2026-33606

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...

AZL-98304 CVE-2026-33606 affecting package dovecot 2.3.20-1

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...

Security update for python36

This update for python36 fixes the following issues: CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF bytes bsc1261969...

SUSE-SU-2026:3855-1 Security update for python36

This update for python36 fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF bytes bsc1261969. -...

Exploit for OS Command Injection in Synacor Zimbra_Collaboration_Suite

Wazuh Rules CVE-2026-73570 Zimbra OS Command Injection Dete...

CVE-2026-33606

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...

CVE-2026-33606

Open-Xchange Dovecot is affected by a vulnerability in the dsync protocol's stream mode. Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration or replication...