CVE-2024-43648 Authenticated command injection via <redacted>.exe <redacted> parameter

Command injection in the parameter of a .exe request leads to remote code execution as the root user. This issue affects Iocharger firmware for AC models before version 24120701. Likelihood: Moderate – This action is not a common place for command injection vulnerabilities to occur. Thus, an...

CVE-2024-22063 ZTE ZENIC ONE R58 product has a CSV injection vulnerability

The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerability to tamper with messages, inject malicious code, and subsequently launch attacks on related devices...

CVE-2024-53256

CVE-2024-53256 affects the Rizin project. A command injection flaw exists in rizin.c where an old snippet using rz_core_cmdf to invoke the removed command m can execute, enabling exploitation when a malicious binary defines bclass in RzBinInfo and rclass is set to fs; this can affect any bin form...

CVE-2024-12686

A vulnerability has been discovered in Privileged Remote Access PRA and Remote Support RS which can allow an attacker with existing administrative privileges to inject commands and run as a site user. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value...

PT-2024-17298 · Radare2 · Radare2

Name of the Vulnerable Software and Affected Versions: Radare2 affected versions not specified Description: A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. Maliciously crafted inputs can...

CVE-2024-12350

The CVE-2024-12350 entry concerns JFinalCMS 1.0, specifically the Template Handler’s update function in TemplateController.java. The vulnerability stems from manipulation of the content argument, enabling a command injection that can be triggered remotely, with exploits disclosed publicly. Remedi...

PYSEC-2024-187

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287...

NETGEAR R8500 admin_account.cgi Component Command Injection Vulnerability

The NETGEAR R8500 is a wireless router from NETGEAR. A command injection vulnerability exists in the NETGEAR R8500 v1.0.2.160, which stems from the sysNewPasswd parameter in the adminaccount.cgi component failing to correctly filter constructed command special characters, commands, and so on. An...

NETGEAR R8500 genie_fix2.cgi Component Command Injection Vulnerability

The NETGEAR R8500 is a wireless router from NETGEAR. A command injection vulnerability exists in the NETGEAR R8500 v1.0.2.160, which stems from the wangateway parameter in the geniefix2.cgi component failing to correctly filter constructed command special characters, commands, and so on. An...

CVE-2024-20418

creationtimestamp| type| source ---|---|--- 2024-11-06 17:09:06+00:00| seen| https://infosec.exchange/users/cve/statuses/113437106972810589 2024-11-06 17:29:02+00:00| seen| https://infosec.exchange/users/vuldb/statuses/113437189233894586 2024-11-07 06:04:53+00:00| seen|...

PT-2024-34711

Name of the Vulnerable Software and Affected Versions: CyberPanel versions prior to 2.3.5 Description: CyberPanel aka Cyber Panel is susceptible to a command injection issue. This allows for unauthenticated remote code execution through the /filemanager/upload endpoint via shell metacharacters. T...

PT-2024-8543 · NetGear · Netgear R7000P

Name of the Vulnerable Software and Affected Versions: Netgear R7000P version 1.3.3.154 Description: The issue is related to a command injection vulnerability via the device name2 parameter at the "operation mode.cgi" endpoint. This allows attackers to execute arbitrary OS commands via a crafted...

Tenda AC1206 Command Injection Vulnerability (CNVD-2024-41056)

The Tenda AC1206 is a wireless Gigabit router from Tenda China. The Tenda AC1206 suffers from a command injection vulnerability that stems from manipulation of the ateiwprivset/ateifconfigset functions in the file /goform/ate, which can lead to command injection. No detailed vulnerability details...

CVE-2024-20444 Cisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability

A vulnerability in Cisco Nexus Dashboard Fabric Controller NDFC, formerly Cisco Data Center Network Manager DCNM, could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device. This vulnerability is due to insufficient...

CVE-2024-44678

Gigastone TR1 Travel Router R101 v1.0.2 is vulnerable to Command Injection. This allows an authenticated attacker to execute arbitrary commands on the device by sending a crafted HTTP request to the ssid parameter in the request...

DedeCMS Command Injection Vulnerability

DedeCMS Dream Weaving Content Management System is a PHP-based open source content management system CMS. The system has content publishing, content management, content editing and content retrieval functions. DedeCMS has a command injection vulnerability that stems from the articlestringmix.php...

GO-2023-2026 CasaOS Command Injection vulnerability in github.com/IceWhaleTech/CasaOS

CasaOS Command Injection vulnerability in github.com/IceWhaleTech/CasaOS...

PT-2024-8128 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A6000R version 1.0.1-B20201211.2000 Description: The issue is related to a command injection vulnerability in the apcli do enr pbc wps function. This vulnerability is associated with the failure to neutralize special elements used in...

CVE-2024-41320

TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the getapcliconninfo function...

CVE-2024-35397

TOTOLINK CP900L v4.1.5cu.798B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...