CVE-2017-14404

The EyesOfNetwork web interface aka eonweb 5.1-0 allows local file inclusion via the toollist parameter aka the urltool variable to module/toolall/selecttool.php, as demonstrated by a toollist=php://filter/ substring...

CVE-2017-14118

In the EyesOfNetwork web interface aka eonweb 5.1-0, module\toolall\tools\interface.php does not properly restrict exec calls, which allows remote attackers to execute arbitrary commands via shell metacharacters in the hostlist parameter to module/toolall/selecttool.php...