4785 matches found
CVE-2021-4045
CVE-2021-4045 CVE-2021-4045 es una vulnerabilidad de inyecciĆ³n de comandos que permite la ejecuciĆ³n remota de cĆ³digo en la cĆ”mara IP TP-Link Tapo c200. Afecta a todas las versiones de firmware anteriores a 1.1.16 Build 211209 Rel. 37726N debido a comprobaciones insuficientes de la entrada del...
CVE-2024-21534-poc
Vulnerabilidad: CVE-2024-21534 Gravedad: CrĆtica PuntuaciĆ³n CVSS: 9.8 DescripciĆ³n: El paquete jsonpath-plus versiones = 10.0.7 es vulnerable a una vulnerabilidad de EjecuciĆ³n Remota de CĆ³digo RCE que permite a los atacantes ejecutar cĆ³digo arbitrario a travĆ©s del mĆ³dulo VM de Node.js. Esta...
Grafana <= 6.7.1 - Cross-Site Scripting
Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...
CVE-2021-36260-hikvision
CVE-2021-36260 CVE-2021-36260 POC de vulnerabilidad de inyecciĆ³n de comandos en el servidor web de algunos productos Hikvision. Debido a una validaciĆ³n insuficiente de entrada, un atacante puede explotar la vulnerabilidad para lanzar un ataque de inyecciĆ³n de comandos enviando mensajes con comand...
CVE-2019-19781
Este artĆculo trata sobre la ejecuciĆ³n remota de cĆ³digo RCE por Directory Traversal en Citrix ADC and Gateway, registrada como CVE-2019-19781. Esta vulnerabilidad de ejecuciĆ³n remota de cĆ³digo se produce porque no se valida adecuadamente el archivo smb.conf en ../vpns bajo la ruta /vpn. Permite...
CVE-2025-57819
CVE-2025-57819 - EjecuciĆ³n remota de cĆ³digo no autenticada RCE en FreePBX CVE-2025-57819 es una vulnerabilidad crĆtica de ejecuciĆ³n remota de cĆ³digo RCE que afecta a Sangoma FreePBX en las versiones 15, 16 y 17. La vulnerabilidad se debe a una sanitizaciĆ³n insuficiente de las entradas controladas...
CVE-2026-88062
OmniRoute (open-source AI gateway) versions 3.8.49 and earlier are affected by a remote code execution flaw in the POST /api/acp/agents custom ACP agent endpoint. Attacker-controlled binary and versionCommand values pass a self-consistency check and a limited metacharacter filter (tokenizeVersion...
Grafana Post-Auth DuckDB - SQL Injection To File Read
The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or highe...
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
The vulnerability of the Chromoting component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.
The vulnerability of the Chromoting component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...
The vulnerability of PDF components in Google Chrome and Microsoft Edge web browsers allows attackers to compromise data integrity.
The vulnerability of PDF components in Google Chrome and Microsoft Edge browsers is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to manipulate data integrity through a specially created HTML page...
CVE-2026-18794 OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite
The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data...
CVE-2026-78237 Insufficient input validation in Admin By Request (ABR)
Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended...
Security Bulletin: Vulnerability in Internationalized Domain Names in Applications (IDNA) for Python affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.
Summary Potential vulnerability in Internationalized Domain Names in Applications IDNA for Python has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed...
CVE-2026-71918
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pwencode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability vi...
EUVD-2026-64989
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...
CVE-2026-71905
Multiple DrayTek VigorAP models are affected by a command injection vulnerability in the ExportSettings function. The root cause is insufficient filtering of the backupkey, backuptype, and realtime parameters before command execution, allowing a remote attacker with valid administrative credentia...
CVE-2026-76314 Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution RCE by submitting crafted Splunk Web Manager Configuration content. The user could then access all relevant data and affect syst...
CVE-2026-75616 Command Injection in Router Web Management Interface
An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting...
CVE-2026-20232
The web-based management interface of Cisco IE 1000 Series Switches fails to validate user-supplied input, enabling an authenticated attacker to inject malicious script into specific pages that executes in another user's session (stored XSS). CVSS 5.4 (MEDIUM) requires valid credentials and user ...