CVE-2024-28138

creationtimestamp| type| source ---|---|--- 2024-12-10 07:39:51+00:00| seen| https://infosec.exchange/users/cve/statuses/113627390966751285 2024-12-10 09:56:52+00:00| seen| https://t.me/cvedetector/12484...

CVE-2024-28138 OS Command Injection

An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msgevents.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized...