CVE-2023-52032

TOTOlink EX1200T V4.1.2cu.5232B20210713 was discovered to contain a remote command execution RCE vulnerability via the "main" function...

QNAP QVR Command Injection

The vulnerability of the QNAP QVR video surveillance system exists due to the failure to take measures to neutralize certain elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Siemens CP-8031 security vulnerability

The SICAM A8000 rtu remote terminal unit series is a modular family of devices for remote control and automation applications in all areas of energy supply. A command injection vulnerability exists in the Siemens CPCI85 Firmware of SICAM A8000 Devices, which can be exploited by an authenticated,...

Exploit for CVE-2022-36267

CVE-2022-36267 - Airspan AirSpot 5410 Unauthenticated Remote C...

CVE-2024-0297

A vulnerability was found in Totolink N200RE 9.3.5u.6139B20201216 and classified as critical. This issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack may be initiated remotely. The...

CVE-2024-0294

A vulnerability, which was classified as critical, has been found in Totolink LR1200GB 9.1.0u.6619B20230130. Affected by this issue is the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to os command injection. The attack may be launched remotely. T...

CVE-2024-0293

A vulnerability classified as critical was found in Totolink LR1200GB 9.1.0u.6619B20230130. Affected by this vulnerability is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack can be launched remotel...

CVE-2024-0292

A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619B20230130. Affected is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to launch the attack remotely. The explo...

CVE-2023-50982

Stud.IP 5.x through 5.3.3 allows XSS with resultant upload of executable files, because uploadaction and editaction in AdminSmileysController do not check the file extension. This leads to remote code execution with the privileges of the www-data user. The fixed versions are 5.3.4, 5.2.6, 5.1.7,...

PT-2024-1056 · Totolink · Totolink Lr1200Gb

Name of the Vulnerable Software and Affected Versions: Totolink LR1200GB version 9.1.0u.6619 B20230130 Description: The issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi, where the manipulation of the FileName argument leads to command injection. This can be exploited...

CVE-2023-41288 Video Station

An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 2023/11/23 and later...

QNAP Systems Video Station Operating System Command Injection Vulnerability

QNAP Systems Video Station is a video management and playback application from QNAP Systems. An operating system command injection vulnerability exists in QNAP Systems Video Station prior to version 5.7.2 2023/11/23 , which stems from the presence of an operating system command injection...

TOTOLINK A7100RU Router Command Execution

The vulnerability of the main function in the csteccgi.cgi script /cgi-bin/cstecgi.cgi?action=login of the TOTOLINK A7100RU router software is related to the output of operations that go beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

CyberPanel < 2.3.8 Remote Command Execution

CyberPanel version prior to 2.3.8 are affected by a vulnerability allowing an unauthenticated attacker to execute commands on the remote machine via a specially forged request. No source data...

CVE-2024-21623

OTCLient is an alternative tibia client for otserv. Prior to commit db560de0b56476c87a2f967466407939196dd254, the /mehah/otclient "Analysis - SonarCloud" workflow is vulnerable to an expression injection in Actions, allowing an attacker to run commands remotely on the runner, leak secrets, and...

Exploit for Command Injection in Flir Flir_Ax8_Firmware

CVE-2023-51126 FLIR AX8 up to 1.46.16 is vulnerable to command...

CVE-2024-21623: Improper Neutralization of Special Elements in Output Used by a Downstream Component

OTCLient is an alternative tibia client for otserv. Prior to commit db560de0b56476c87a2f967466407939196dd254, the /mehah/otclient "Analysis - SonarCloud" workflow is vulnerable to an expression injection in Actions, allowing an attacker to run commands remotely on the runner, leak secrets, and...

OTCLient Injection Vulnerability

OTCLient is a replacement tibia client for otserv, written in C++20 and Lua, and is made on a modular system that uses lua scripting to implement in-game interfaces and features. OTCLient suffers from an injection vulnerability. An attacker could use this vulnerability to remotely run commands on...

Proscend M330-w Command Injection

The vulnerability of Proscend M330-w, M330-W5, M350-5G, M350-W5G, M350-6, M350-W6, M301-G, M301-GW, and ICR 111WG microprogrammed software in industrial routers is related to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this...

downFiles Command Execution

The vulnerability of the downFiles function in the microprogramming software for wireless access point controllers Ruijie WS6008 and WS6108 is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow a malicious actor to execute arbitrary...