CVE-2024-28138 OS Command Injection

An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msgevents.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized...

CVE-2024-28138

Image Access Scan2Net versions 7.40 and earlier , 7.42 and earlier , and 7.42B and earlier are vulnerable to an OS Command Injection (CWE-78). The root cause is the improper sanitization of the HTTP GET parameter "data" within the "msg_events.php" script. An unauthenticated attacker with network ...

CVE-2024-28138: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msgevents.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized...