CVE-2024-39759

Multiple OS command injection vulnerabilities exist in the login.cgi setsysinit functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A comman...

CVE-2024-39759

CVE-2024-39759 affects the Wavlink AC3000 M33A8.V5030.210505 router, where multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() function. The root cause is improper handling of input in the restart_hour_value (and related) POST parameters, which can be invoked by un...

CVE-2024-39761

Multiple OS command injection vulnerabilities exist in the login.cgi setsysinit functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A comman...

CVE-2024-57687

An OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the "Cookie" GET request parameter...

The vulnerability of the update_ex_detail.php script in the Portfolio Management System allows a perpetrator to gain unauthorized access to read, modify, and delete data, as well as execute arbitrary code.

The vulnerability of the updateexdetail.php script in the Portfolio Management System is related to the failure to eliminate special elements during the processing of the q parameter. Exploiting this vulnerability allows an attacker who operates remotely to gain unauthorized access to read, modif...

WordPress Simple Ecommerce Shopping Cart plugin <= 3.1.2 - Reflected Cross-Site Scripting via monthly_sales_current_year Parameter vulnerability

Reflected Cross-Site Scripting via monthlysalescurrentyear Parameter vulnerability discovered by vgo0 in WordPress Plugin Simple Ecommerce Shopping Cart versions = 3.1.2...

WordPress Email Address Obfuscation plugin <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via class Parameter vulnerability discovered by theviper17y in WordPress Plugin Email Address Obfuscation versions = 1.0.1...

TOTOLINK EX200 安全漏洞

TOTOLINK EX200 is a 2.4G wireless N range extender from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK EX200 ssd parameter handling, which can be exploited by remote attackers to submit a special request that can be used to execute arbitrary commands in the...

Projectworlds Free Download Online Shopping System SQL注入漏洞

Projectworlds Free Download Online Shopping System is an online shopping system from Projectworlds India. Projectworlds Free Download Online Shopping System 192.168.1.88 and earlier versions have a SQL injection vulnerability that stems from a SQL injection vulnerability in the parameter id...

AMTT Hotel Broadband Operation System 代码注入漏洞

AMTT Hotel Broadband Operation System is a hotel broadband operation system from China's AmTech Century AMTT. A code injection vulnerability exists in AMTT Hotel Broadband Operation System HiBOS 3.0.3.151204 and earlier versions, which originates from the parameter LangID/LangName/LangEName in th...

Interlib Library Cluster Automation Management System 注入漏洞

Interlib Library Cluster Automation Management System is a library cluster automation management system from Interlib. An injection vulnerability exists in Interlib Library Cluster Automation Management System 2.0.1 and earlier versions, which is caused by SQL injection in the parameter sql...

Courier Management System /login.php File SQL Injection Vulnerability

Courier Management System is a courier management system. Courier Management System suffers from a SQL injection vulnerability that originates from improper handling of the txtusername parameter in the /login.php file. An attacker could exploit this vulnerability to disclose sensitive information...

Code-Projects Blood Bank Management System 跨站请求伪造漏洞

Code-Projects Blood Bank Management System is a Code-Projects open source blood bank management system. A cross-site request forgery vulnerability exists in Code-Projects Blood Bank Management System version 1.0, which stems from a cross-site request forgery caused by the parameter bid in the fil...

CVE-2024-48233

mipjz 5.0.5 is vulnerable to Cross Site Scripting XSS in \app\setting\controller\ApiAdminSetting.php via the ICP parameter...

CVE-2024-43700

xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment...

Tenda AX1806 iptv.stb.port parameter stack overflow vulnerability

The Tenda AX1806 is a WiFi6 wireless router from Tenda, a Chinese company. Tenda AX1806 A stack overflow vulnerability exists in the iptv.stb.port parameter, which originates from the parameter iptv.stb.port in the function setIptvInfo that fails to correctly validate the length of the input data...

CVE-2024-44555

CVE-2024-44555 pertains to the Tenda AX1806 router. Multiple connected sources confirm a stack overflow in the function setIptvInfo, triggered by the iptv.city.vlan parameter in v1.0.0.1. The vulnerability is described as a stack overflow with high impact (as reflected by CVSS 3.1: Critical). Doc...

The vulnerability of the SIEM system testing tool Kraken Stress Testing Toolkit lies in the lack of measures taken to protect the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of the SIEM systems’ load testing tools, such as the Kraken Stress Testing Toolkit, is related to the lack of measures taken to protect SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by injecting specially crafted data into...

The vulnerability of the `type` parameter in the Netcat module of the netshop CMS system allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the “type” parameter in the netshop CMS system’s Netcat CMS system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code in the user’s browser remotely...

The vulnerability of the “file” parameter in the netshop CMS system’s Netcat module allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the “file” parameter in the netshop CMS system’s Netcat module exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute any arbitrary JavaScript code in the user’s browser remotely...