The vulnerability of the “file” parameter in the netshop CMS system’s Netcat module allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the “file” parameter in the netshop CMS system’s Netcat module exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute any arbitrary JavaScript code in the user’s browser remotely...

CVE-2024-42363 GHSL-2023-136_Samson

Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController. The role parameter flows into the RoleConfigFile initializer and then into the Kubernetes::Util.parsefile method where it is unsafely deserialized using the YAML.loadstream...

Accounting Journal Management System 1.0 Code Injection

============================================================================================================================================= | Title : Accounting Journal Management System 1.0 php code injection Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser :...

The vulnerability of the Routing and Remote Access Service (RRAS) on Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Routing and Remote Access Service RRAS on Windows operating systems is related to buffer overflow attacks. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

CBL Mariner 2.0 Security Update: rust (CVE-2024-32884)

The version of rust installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-32884 advisory. - gitoxide is a pure Rust implementation of Git. gix-transport does not check the username part of a URL for tex...

The vulnerability of the web interface of the microprogramming software for Cisco Small Business SPA300 and SPA500 allows a perpetrator to execute arbitrary commands in the basic operating system.

The vulnerability of the web interface of Cisco Small Business SPA300 and SPA500 microprogramming software lies in the copying of input data into memory without checking its size. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary commands on the basic...

The vulnerability of the web interface of the microprogramming software for Cisco Small Business SPA300 and SPA500 allows a perpetrator to execute arbitrary commands in the basic operating system.

The vulnerability of the web interface of Cisco Small Business SPA300 and SPA500 microprogramming software lies in the copying of input data into memory without checking its size. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary commands on the basic...

USN-6962-1 libreoffice vulnerability

It was discovered that LibreOffice incorrectly allowed users to enable macros when a cryptographic signature failed to validate. If a user were tricked into opening a specially crafted document, a remote attacker could possibly execute arbitrary macros...

LG Simple Editor 3.21.0 Command Injection

class MetasploitModule 'LG Simple Editor Command Injection CVE-2023-40504', 'Description' = %q Unauthenticated Command Injection in LG Simple Editor MSFLICENSE, 'Author' = 'rgod', Vulnerability discovery 'Michael Heinzl' MSF module , 'References' = 'URL',...

LG Simple Editor 3.21.0 Command Injection Exploit

LG Simple Editor versions 3.21.0 and below suffer from an unauthenticated command injection vulnerability. The vulnerability can be exploited by a remote attacker to inject arbitrary operating system commands which will get executed in the context of NT AUTHORITY\SYSTEM. class MetasploitModule 'L...

PT-2024-18568 · Modem · Modem

Name of the Vulnerable Software and Affected Versions: Modem affected versions not specified Description: The issue is related to a possible memory corruption due to a missing bounds check in Modem. This could lead to remote code execution with no additional execution privileges needed. User...

Azure CycleCloud Remote Code Execution Vulnerability

...

D-Link G416 flup lfilename Command Injection Remote Code Execution Vulnerability

The D-Link G416 is the AX1500 4G+ Smart Router launched by AUO in June 2025 and supports Wi-Fi 6, AI Smart Optimization and 4G LTE Cat 6 network with up to 300Mbps internet speed. The D-Link G416 suffers from a command injection remote code execution vulnerability that stems from the flup lfilena...

CVE-2024-37023

Multiple OS command injection vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an authenticated remote attacker to execute arbitrary OS commands via various endpoint parameters...

Exploit for Incorrect Authorization in Nexxtsolutions Nebula1200-Ac_Firmware

EN This project provides a proof-of-concept exploit for a remo...

The vulnerability of the restapi.service (/lib/systemd/system/restapi.service) software for creating wireless routers based on Debian RaspAP allows a attacker to escalate their privileges and execute arbitrary commands.

The vulnerability of the restapi.service file /lib/systemd/system/restapi.service in the software for creating wireless routers based on Debian RaspAP is related to the lack of measures taken to neutralize special elements used in commands, due to insufficient access control for users belonging t...

PT-2024-6682 · Tenda · Tenda Fh1206

Name of the Vulnerable Software and Affected Versions: Tenda FH1206 version 1.2.0.88155 Description: A critical issue affects the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer. The manipulation of the argument dips leads to a buffer overflow. This can be exploited remotely, allowin...

The vulnerability of the OLE DB driver for SQL Server, related to insufficient validation of input data, allows a hacker to execute arbitrary code.

The vulnerability of the OLE DB driver for SQL Server is related to buffer overflow in the “heap”. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...

Calibre 7.15.0 Python Code Injection

class MetasploitModule 'Calibre Python Code Injection CVE-2024-6782', 'Description' = %q This module exploits a Python code injection vulnerability in the Content Server component of Calibre v6.9.0 - v7.15.0. Once enabled disabled by default, it will listen in its default configuration on all...

The vulnerability of the OLE DB driver for SQL Server, related to buffer overflows in the stack, allows a hacker to execute arbitrary code.

The vulnerability of the OLE DB driver for SQL Server is related to buffer overflow in the stack. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...