CVE-2025-29044

The Netgear R61 wireless router (specifically version V1.0.1.28 ) is vulnerable to a buffer overflow vulnerability in its integrated routing software. The root cause is the copying of buffers without checking the size of the input data during the handling of the QUERY_STRING key value within the ...

CVE-2025-29044: Buffer Copy without Checking Size of Input

Buffer Overflow vulnerability in Netgear- R61 router V1.0.1.28 allows a remote attacker to execute arbitrary code via the QUERYSTRING key value...

CVE-2024-7443 Vivotek IB8367A upload_file.cgi getenv command injection

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in Vivotek IB8367A VVTK-0100b. Affected is the function getenv of the file uploadfile.cgi. The manipulation of the argument QUERYSTRING leads to command injection. It is possible to launch the attack remotely. The...

CVE-2024-7442 Vivotek SD9364 upload_file.cgi getenv command injection

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been rated as critical. This issue affects the function getenv of the file uploadfile.cgi. The manipulation of the argument QUERYSTRING leads to command injection. The attack may be initiated remotely. The...

CVE-2024-7443: Improper Neutralization of Special Elements used in a Command

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in Vivotek IB8367A VVTK-0100b. Affected is the function getenv of the file uploadfile.cgi. The manipulation of the argument QUERYSTRING leads to command injection. It is possible to launch the attack remotely. The...

CVE-2024-7442: Improper Neutralization of Special Elements used in a Command

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been rated as critical. This issue affects the function getenv of the file uploadfile.cgi. The manipulation of the argument QUERYSTRING leads to command injection. The attack may be initiated remotely. The...

CVE-2024-7440: Improper Neutralization of Special Elements used in a Command

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in Vivotek CC8160 VVTK-0100d. It has been classified as critical. This affects the function getenv of the file uploadfile.cgi. The manipulation of the argument QUERYSTRING leads to command injection. It is possible to initiate the attack remotel...

CVE-2022-48069

Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERYSTRING parameter...

Command injection

Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERYSTRING parameter...

CVE-2022-48069

Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERYSTRING parameter...

CVE-2022-48069: Improper Neutralization of Special Elements used in an OS Command

Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERYSTRING parameter...

CVE-2022-48069

Totolink A830R V4.1.2cu.5182 is affected by CVE-2022-48069: a command injection via QUERY_STRING parameter, allowing network-based exploitation with no user interaction. Reported CVSSv3.1 base score 7.5 (High); impact on confidentiality (High) with no integrity/availability impact. Exploitation a...

CVE-2022-48069

Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERYSTRING parameter...

Cross-site Scripting (XSS)

fava is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in the querystring parameters of Query.svelte, allowing an attacker to inject and execute malicious javascript...

CVE-2022-32092

D-Link DIR-645 v1.03 was discovered to contain a command injection vulnerability via the QUERYSTRING parameter at ajaxexplorer.sgi...

Command injection

D-Link DIR-645 v1.03 was discovered to contain a command injection vulnerability via the QUERYSTRING parameter at ajaxexplorer.sgi...

EUVD-2022-53360

D-Link DIR-645 v1.03 was discovered to contain a command injection vulnerability via the QUERYSTRING parameter at ajaxexplorer.sgi...

CVE-2022-32092

CVE-2022-32092 affects the D-Link DIR-645 router (v1.03) with a command injection vulnerability exposed through the QUERY_STRING parameter in the __ajax_explorer.sgi endpoint. Red Hat/OpenVAS/CVE aggregations and the NVD entry all describe this as a remote, unauthenticated, network-executable iss...

CVE-2022-32092

D-Link DIR-645 v1.03 was discovered to contain a command injection vulnerability via the QUERYSTRING parameter at ajaxexplorer.sgi...

CVE-2022-32092: Improper Neutralization of Special Elements used in an OS Command

D-Link DIR-645 v1.03 was discovered to contain a command injection vulnerability via the QUERYSTRING parameter at ajaxexplorer.sgi...