CVE-2026-26794

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the addgroup function. This vulnerability allows attackers to execute arbitrary SQL database operations via a crafted HTTP request...

CVE-2026-26791

GL-iNet GL-AR300M16 v4.3.11 contains a command injection vulnerability in the enable_echo_server function exposed via the port parameter. A crafted input can lead to arbitrary command execution on the device. The CVE entry indicates a network-exposed impact with high severity, but the provided do...

CVE-2026-26794

CVE-2026-26794 affects GL-iNet GL-AR300M16 (v4.3.11). Connected sources specify a SQL injection via the add_group() function, enabling an attacker to perform arbitrary SQL operations through a crafted HTTP request. The CVSS 3.1 metrics in the initial entry indicate NETWORK access, HIGH impact on ...

CVE-2026-26795

CVE-2026-26795 affects GL-iNet GL-AR300M16 running v4.3.11. The issue is a command injection via the module parameter in the M.get_system_log function, allowing execution of arbitrary commands. Impact is high (confidentiality, integrity, and availability), with network-based exploitation and no p...

CVE-2026-26792

GL-iNet GL-AR300M16 v4.3.11 contains multiple command-injection vulnerabilities in the set_upgrade function accessible via the modem_url, target_version, current_version, firmware_upload, hash_type, hash_value, and upgrade_type parameters. Exploitation allows arbitrary command execution through c...

CVE-2026-26794

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the addgroup function. This vulnerability allows attackers to execute arbitrary SQL database operations via a crafted HTTP request...

CVE-2026-26793

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the setconfig function. This vulnerability allows attackers to execute arbitrary commands via a crafted input...

CVE-2026-26793: Improper Neutralization of Special Elements used in a Command

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the setconfig function. This vulnerability allows attackers to execute arbitrary commands via a crafted input...

CVE-2026-26794: Improper Neutralization of Special Elements used in an SQL Command

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the addgroup function. This vulnerability allows attackers to execute arbitrary SQL database operations via a crafted HTTP request...

CVE-2026-26792: Improper Neutralization of Special Elements used in a Command

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the setupgrade function via the modemurl, targetversion, currentversion, firmwareupload, hashtype, hashvalue, and upgradetype parameters. These vulnerabilities allow attackers to execute arbitrary...

CVE-2026-26791: Improper Neutralization of Special Elements used in a Command

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enableechoserver function. This vulnerability allows attackers to execute arbitrary commands via a crafted input...

CVE-2026-26792

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the setupgrade function via the modemurl, targetversion, currentversion, firmwareupload, hashtype, hashvalue, and upgradetype parameters. These vulnerabilities allow attackers to execute arbitrary...

PT-2026-25049

🔴 CVE-2026-26793 - Critical GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set config function. This vulnerability allows attackers to execute arbitrary commands via ... https://t.co/4ioEauePbG https://t.co/UVrVh3JYcc...

Exploit for OS Command Injection in Gl-Inet Gl-Mt300N-V2_Firmware

🥭 MangoPunch: CVE-2022-31898 Authenticated OS Command Inje...

The vulnerability of the skb_vlan_inet_prepare() function in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the skbvlaninetprepare function in the operating system’s kernel is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2020-37045 NetBackup 7.0 - 'NetBackup INET Daemon' Unquoted Service Path

Veritas NetBackup 7.0 contains an unquoted service path vulnerability in the NetBackup INET Daemon service that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe to inject malicious code that wou...

CVE-2020-37045

CVE-2020-37045 affects Veritas NetBackup 7.0. The vulnerability is an unquoted service path in the NetBackup INET Daemon (bpinetd.exe under C:\Program Files\Veritas\NetBackup\bin). This unquoted path can be exploited by local users to execute arbitrary code with elevated LocalSystem privileges. E...

CVE-2020-37045

Veritas NetBackup 7.0 contains an unquoted service path vulnerability in the NetBackup INET Daemon service that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe to inject malicious code that wou...

EUVD-2020-30972

Veritas NetBackup 7.0 contains an unquoted service path vulnerability in the NetBackup INET Daemon service that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe to inject malicious code that wou...

CVE-2020-37045 NetBackup 7.0 - 'NetBackup INET Daemon' Unquoted Service Path

Veritas NetBackup 7.0 contains an unquoted service path vulnerability in the NetBackup INET Daemon service that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe to inject malicious code that wou...