CVE-2021-46226

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wgettest.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter...

CVE-2021-46226

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wgettest.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter...

CVE-2021-45734

TOTOLINK X5000R v9.1.0u.6118B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service DoS via the url parameter...

Command injection

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wgettest.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter...

Stack overflow

TOTOLINK X5000R v9.1.0u.6118B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service DoS via the url parameter...

CVE-2021-45734

TOTOLINK X5000R v9.1.0u.6118B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service DoS via the url parameter...

CVE-2021-46226

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wgettest.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter...

PT-2022-12376 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version 9.1.0u.6118 B20201102 Description: The issue is related to a stack overflow in the setUrlFilterRules function, allowing attackers to cause a Denial of Service DoS via the url parameter. Recommendations: For TOTOLINK...

CVE-2021-45734: Undefined Security Weakness

TOTOLINK X5000R v9.1.0u.6118B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service DoS via the url parameter...

CVE-2021-46226: Improper Neutralization of Special Elements used in a Command

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wgettest.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter...

CVE-2022-0381: Improper Neutralization of Input During Web Page Generation

The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the /swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and...

CVE-2022-22792

MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters Attacker can navigate to specific url which will expose all the users and password in clear text. http://IP/MobiPlusWeb/Handlers/MainHandler.ashx?MethodName=GridData&GridName=Users...

CVE-2021-45224: Improper Neutralization of Input During Web Page Generation

An issue was discovered in COINS Construction Cloud 11.12. In several locations throughout the application, JavaScript code is passed as a URL parameter. Attackers can trivially alter this code to cause malicious behaviour. The application is therefore vulnerable to reflected XSS via malicious UR...

PT-2022-1559

Name of the Vulnerable Software and Affected Versions D-Link device DI-7200GV2.E1 version 21.04.09E1 Description The issue is related to a command injection vulnerability in the wget test.asp function. This vulnerability allows attackers to execute arbitrary commands via the url parameter. The...

Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the wyppagetype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-44916

Opmantek Open-AudIT Community 4.2.0 Fixed in 4.3.0 is affected by a Cross Site Scripting XSS vulnerability. If a bad value is passed to the routine via a URL, malicious JavaScript code can be executed in the victim's browser...

CVE-2021-44163

Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attacker to perform JavaScript injection for XSS reflected Cross-site scripting attack without authentication...

CVE-2021-44162

CVE-2021-44162 affects Chain Sea AI chatbot system. The root cause is a path traversal vulnerability in the file download function caused by improper filtering of special URL parameters, allowing an unauthenticated remote attacker to download arbitrary system files. Per the sources, this is a net...

Exploit for Path Traversal in Grafana

CVE-2021-43798 Grafana任意文件读取 1.installation shell pip3...

HTTP Method Spoofing

Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE requests. This bypasses restrictions otherwise put on these types of requests...