Lucene search
+L

75971 matches found

BDU FSTEC
BDU FSTEC
added 2026/08/25 12:18 a.m.28 views

The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager lies in the lack of a mechanism for verifying input data during backup scenarios. This allows a malicious actor to execute arbitrary code with SYSTEM privileges.

The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager is related to deficiencies in the mechanism for verifying input data during backup scenario execution. Exploiting this vulnerability could allow an attacker, operating...

9.1CVSS6.1AI score0.00648EPSS
SaveExploits0References2Affected Software1
NVD
NVD
added 2026/08/24 6:17 p.m.6 views

CVE-2026-71927

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execut...

8.6CVSS
SaveExploits0References2
NVD
NVD
added 2026/08/24 6:17 p.m.4 views

CVE-2026-71924

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

8.6CVSS
SaveExploits0References2
NVD
NVD
added 2026/08/24 6:17 p.m.3 views

CVE-2026-71917

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary...

8.6CVSS
SaveExploits0References2
NVD
NVD
added 2026/08/24 6:17 p.m.5 views

CVE-2026-71919

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input ...

8.6CVSS
SaveExploits0References2
NVD
NVD
added 2026/08/24 6:17 p.m.6 views

CVE-2026-71915

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input...

8.6CVSS
SaveExploits0References2
NVD
NVD
added 2026/08/24 6:17 p.m.4 views

CVE-2026-71909

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands...

8.6CVSS
SaveExploits0References2
NVD
NVD
added 2026/08/24 6:17 p.m.6 views

CVE-2026-71907

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary...

8.6CVSS
SaveExploits0References2
NVD
NVD
added 2026/08/24 6:17 p.m.4 views

CVE-2026-71905

Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted...

8.6CVSS
SaveExploits0References2
NVD
NVD
added 2026/08/24 6:17 p.m.4 views

CVE-2026-71904

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the eventcode field is concatenated into a system command. A remote attacker can trigger this vulnerabili...

8.6CVSS
SaveExploits0References2
NVD
NVD
added 2026/08/24 6:16 p.m.5 views

CVE-2026-16348

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...

8.5CVSS
SaveExploits1References3
CVE
CVE
added 2026/08/24 5:25 p.m.16 views

CVE-2026-16348

TP-Link Archer BE800 V1 is affected by an authenticated command injection in its VPN connection handling. An attacker with administrative access can inject shell metacharacters via the VPN connection to execute arbitrary system commands with root privileges . Successful exploitation may enable pe...

8.5CVSS5.8AI score
SaveExploits1References3
EUVD
EUVD
added 2026/08/24 5:25 p.m.5 views

EUVD-2026-65007

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...

8.5CVSS6AI score
SaveExploits1References3
Cvelist
Cvelist
added 2026/08/24 5:25 p.m.18 views

CVE-2026-16348 Command Injection Vulnerability in VPN connection of Archer BE800

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...

8.5CVSS
SaveExploits1References3
Cvelist
Cvelist
added 2026/08/24 5:25 p.m.17 views

CVE-2026-9254 Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices

An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute th...

8.7CVSS
SaveExploits0References8
CVE
CVE
added 2026/08/24 5:25 p.m.15 views

CVE-2026-9254

An unauthenticated OS command injection vulnerability exists in the parental control functionality of TP-Link Archer BE800 V1, BE3600 V1, and AX75 V1 routers, caused by improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker with no prior access can...

8.7CVSS5.7AI score
SaveExploits0References8
EUVD
EUVD
added 2026/08/24 5:25 p.m.7 views

EUVD-2026-65006

An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute th...

8.7CVSS5.9AI score
SaveExploits0References8
CVE
CVE
added 2026/08/24 5:08 p.m.10 views

CVE-2026-71943

DrayTek VigorSwitch multiple models are affected by an OS command injection vulnerability in the setDevNet function. The root cause is insufficient filtering of the username and password fields before they are passed to command execution. A remote attacker with valid administrative credentials fo...

8.6CVSS6.1AI score
SaveExploits0References2
EUVD
EUVD
added 2026/08/24 5:08 p.m.7 views

EUVD-2026-65002

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execut...

8.6CVSS6.2AI score
SaveExploits0References2
CVE
CVE
added 2026/08/24 5:07 p.m.11 views

CVE-2026-71931

Multiple DrayTek VigorSwitch models are affected by an OS command injection vulnerability in the tftp_upgrade function. The root cause is insufficient filtering of the filename field before it is concatenated into a system command, allowing a remote attacker to execute arbitrary commands with roo...

8.6CVSS6AI score
SaveExploits0References2
Rows per page
Query Builder