CVE-2026-2686

A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/sessionlogin.cgi. The manipulation of the argument User leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclose...

Dell Unisphere SQL Injection

The vulnerability of the data processing application Dell Unisphere for PowerMax and the virtualization software Dell Unisphere for PowerMax Virtual Appliance is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute...

MCP Server Arbitrary Command Execution

The vulnerability of the MCP server regarding the execution of container code via node-code-sandbox-mcp is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary system commands...

PT-2026-21023

Name of the Vulnerable Software and Affected Versions UTT HiPER 520 version 1.7.7-160105 Description A security issue exists in UTT HiPER 520. The sub 44D264 function within the /goform/formPdbUpConfig file of the Web Management Interface is susceptible to operating system command injection. This...

Smanga security vulnerabilities

Smanga is a Docker-based comic streaming reading tool developed by lkw199711. Version 3.2.7 of Smanga has a security vulnerability. This vulnerability stems from improper handling of the mediaId parameter in the /php/path/rescan.php interface. It could allow unverified attackers to inject operati...

PT-2026-21024

Name of the Vulnerable Software and Affected Versions UTT HiPER 520 version 1.7.7-160105 Description A flaw exists in the Web Management Interface component of UTT HiPER 520. Specifically, manipulating the Isp Name argument within the sub 44EFB4 function of the /goform/formReleaseConnect file can...

Wavlink Router Arbitrary Command Execution

The vulnerability of the /cgi-bin/login.cgi file in the microprogramming software for Wavlink WL-WN579A3 is related to the lack of measures taken to neutralize data at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

Wavlink Delete_Mac_list Command Execution

The vulnerability of the DeleteMaclist function in the /cgi-bin/wireless.cgi file of the Wavlink WL-WN579A3 router’s microprogramming system is related to the lack of measures taken to neutralize such data at the control level. Exploiting this vulnerability could allow a malicious actor to execut...

Wavlink WL-WN579A3 system multi_ssid Command Execution

The vulnerability of the multissid function in the /cgi-bin/wireless.cgi file of the Wavlink WL-WN579A3 router microprogramming system is related to the lack of measures taken to neutralize data at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary...

Tenda AC1206 Router Arbitrary Command Execution

The vulnerability of the httpd component of the formBehaviorManager function in the Tenda AC1206 router microprogramming system is related to the lack of data cleaning measures at the management level. Exploiting this vulnerability may allow an attacker to execute arbitrary commands remotely...

CVE-2026-2686

A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/sessionlogin.cgi. The manipulation of the argument User leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclose...

CVE-2026-2686 SECCN Dingcheng G10 session_login.cgi qq os command injection

A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/sessionlogin.cgi. The manipulation of the argument User leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclose...

CVE-2026-2686 SECCN Dingcheng G10 session_login.cgi qq os command injection

A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/sessionlogin.cgi. The manipulation of the argument User leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclose...

📄 Shenzhen Aitemi M300 Wi-Fi Repeater Remote Code Execution

Shenzhen Aitemi M300 Wi-Fi Repeater unauthenticated proof of concept remote code execution exploit that leverages the time parameter in protocol.csp. ============================================================================================================================================= | Tit...

📄 Serendipity 2.5.0 PHP Code Injection

Serendipity version 2.5.0 proof of concept PHP code injection exploit. ============================================================================================================================================= | Title : Serendipity 2.5.0 PHP COde Injection Vulnerability | | Author : indoushka ...

FLIR Systems AX8 Cameras Command Injection (CVE-2025-5695)

A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. This impacts the function subscribetospot/subscribetodelta/subscribetoalarm of the file /usr/www/application/models/subscriptions.php of the component Backend. Such manipulation leads to command injection. It is possible to launch...

FLIR Systems AX8 Cameras OS Command Injection (CVE-2022-37061)

All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. A successful exploit could allow th...

PT-2026-20559

Name of the Vulnerable Software and Affected Versions SECCN Dingcheng G10 version 3.1.0.181203 Description A security issue has been identified in SECCN Dingcheng G10 version 3.1.0.181203. The qq function within the /cgi-bin/session login.cgi file is susceptible to operating system command...

FLIR Systems AX8 Cameras Command Injection (CVE-2025-5126)

A vulnerability was found in Teledyne FLIR AX8 up to 1.46.16. This vulnerability affects the function setDataTime of the file \usr\www\application\models\settingsregional.php. Performing manipulation of the argument year/month/day/hour/minute results in command injection. The attack may be...

CVE-2026-2670

A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.120251110. Affected is an unknown function o...