D-Link DIR-878和D-Link DIR-882 安全漏洞

The D-Link DIR-878 is a wireless router.The D-Link DIR-882 is a dual-band wireless router. A command injection vulnerability exists in the D-Link DIR-878 and D-Link DIR-882, which can be exploited by an attacker to execute arbitrary operating system commands via a constructed POST request...

CVE-2024-48629

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the IPAddress parameter in the SetGuestZoneRouterSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...

CVE-2024-48630

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the SetMACFilters2 function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...

CVE-2024-48635

D-Link DIR-882 (firmware FW130B06) and DIR-878 (firmware FW130B08) expose a command injection in SetVLANSettings. The root cause is a lack of neutralization of special elements in the VLANID:2/VID parameter, allowing an attacker to run arbitrary OS commands via a crafted POST request. Public sour...

CVE-2024-48638

CVE-2024-48638 affects D-Link DIR-882 (FW130B06) and DIR-878 (FW130B08). The vulnerability is a command injection in SetGuestZoneRouterSettings via the SubnetMask parameter, allowing an attacker to execute arbitrary OS commands through a crafted POST request. The CVSSv3.1 vector is AV:A/AC:L/PR:L...

CVE-2024-48744

A Reflected Cross Site Scripting XSS vulnerability was found in /trms/listed- teachers.php in PHPGurukul Teachers Record Management System v2.1, which allows remote attackers to execute arbitrary code via "searchinput" POST request parameter...

CVE-2024-48744

CVE-2024-48744 affects PHPGurukul Teachers Record Management System v2.1. A reflected Cross-Site Scripting (XSS) vulnerability exists in the /trms/listed-teachers.php endpoint (and variant listed- teachers.php) where an attacker can supply input via the POST parameter “searchinput” to trigger cod...

CVE-2024-48744

A Reflected Cross Site Scripting XSS vulnerability was found in /trms/listed- teachers.php in PHPGurukul Teachers Record Management System v2.1, which allows remote attackers to execute arbitrary code via "searchinput" POST request parameter...

GHSA-2234-FMW7-43WR Hono allows bypass of CSRF Middleware by a request without Content-Type header.

Summary Bypass CSRF Middleware by a request without Content-Type herader. Details Although the csrf middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe...

CVE-2024-48279

A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allows remote attackers to execute arbitrary HTML code via the searchkey parameter in a POST HTTP request...

CVE-2024-48279

A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allows remote attackers to execute arbitrary HTML code via the searchkey parameter in a POST HTTP request...

CVE-2024-9974

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php?f=addtocard of the component POST Request Handler. The manipulation of the argument productid leads to s...

CVE-2024-9974 SourceCodester Online Eyewear Shop POST Request Master.php sql injection

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php?f=addtocard of the component POST Request Handler. The manipulation of the argument productid leads to s...

CVE-2024-9974 SourceCodester Online Eyewear Shop POST Request Master.php sql injection

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php?f=addtocard of the component POST Request Handler. The manipulation of the argument productid leads to s...

CVE-2024-9974

The CVE-2024-9974 entry concerns SourceCodester Online Eyewear Shop 1.0. Affected functionality is in the POST Request Handler, specifically the file classes/Master.php?f=add_to_card, where manipulating the product_id parameter leads to SQL injection. Remote exploitation is possible and public ex...

PT-2024-39972 · Unknown · Sourcecodester Online Eyewear Shop

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Eyewear Shop version 1.0 Description: A critical issue has been found in the software, affecting an unknown functionality of the file classes/Master.php?f=add to card of the component POST Request Handler. The manipulati...

CVE-2024-48279

A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allows remote attackers to execute arbitrary HTML code via the searchkey parameter in a POST HTTP request...

ABB Cylon Aspect 3.07.02 sshUpdate.php Unauthenticated Remote SSH Service Control

ABB Cylon Aspect 3.07.02 sshUpdate.php Unauthenticated Remote SSH Service Control Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.07.02 Summary: ASPECT is an award-winning scalable building...

The vulnerability of the formSafeEmailFilter() function (/goform/SafeEmailFilte) in the Tenda FH1206 router software allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSafeEmailFilter function /goform/SafeEmailFilte in the Tenda FH1206 router software is related to the issue of the operation going out of the buffer in memory when processing the page parameter. Exploiting this vulnerability can allow an attacker to compromise the...

The vulnerability of the formWifiBasicSet() function (/goform/SetOnlineDevName) in the Tenda A301 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formWifiBasicSet function /goform/SetOnlineDevName of the Tenda A301 router’s software lies in the fact that the operation may go beyond the buffer in memory when processing the devName parameter. Exploiting this vulnerability could allow an attacker to compromise the...