GHSA-PWC9-Q4HJ-PG8G LoLLMS Command Injection vulnerability

A vulnerability in the parisneo/lollms, specifically in the /unInstallbinding endpoint, allows for arbitrary code execution due to insufficient sanitization of user input. The issue arises from the lack of path sanitization when handling the name parameter in the unInstallbinding function, allowi...

PT-2024-25795 · Tenda · Tenda O3V2

Name of the Vulnerable Software and Affected Versions: Tenda O3V2 versions V1.0.0.10 through V1.0.0.12 Description: The issue is related to a Blind Command Injection via the dest parameter in the "/goform/getTraceroute" API endpoint. This allows attackers to execute arbitrary commands with root...

CVE-2024-22836

An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server...

SUSE-SU-2024:0158-1 Security update for perl-Spreadsheet-ParseExcel

This update for perl-Spreadsheet-ParseExcel fixes the following issues: - CVE-2023-7101: Fixed a command injection issue when parsing an untrusted spreadsheet bsc1218414...

TOTOLINK A3300R setDdnsCfg Method Command Injection Vulnerability

TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK A3300R version V17.0.0cu.557B20221024, which stems from the username parameter of the setDdnsCfg method failing to correctly filter construct command special...

PT-2023-8388 · D Link · D-Link Dir-822

Name of the Vulnerable Software and Affected Versions: D-Link DIR-822+ version 1.0.2 Description: The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This allows a remote attacker to execute arbitrary commands via the shell by exploiti...

CVE-2023-50983

Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function...

CVE-2023-50989

Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the pingSet function...

CVE-2023-50989

Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the pingSet function...

CVE-2023-26156

Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system. Note: An attacker must have access to the system...

CVE-2023-45498

VinChin Backup & Recovery v5.0., v6.0., v6.7., and v7.0. was discovered to contain a command injection vulnerability...

PT-2023-20534 · Node-Qpdf · Node-Qpdf

Name of the Vulnerable Software and Affected Versions: node-qpdf versions all Description: The issue arises from the encrypt method failing to sanitize its parameter input, which later flows into a sensitive command execution API. This allows attackers to inject malicious commands once they can...

PT-2023-29557 · Netis · Netis N3Mv2

Name of the Vulnerable Software and Affected Versions: Netis N3Mv2 version 1.0.1.865 Description: A command injection issue was discovered via the pin host parameter in the WPS Settings, allowing for potential exploitation. Recommendations: For Netis N3Mv2 version 1.0.1.865, consider restricting...

Exploit for Command Injection in Php

PHP CGI Argument Injection CVE-2012-1823 !PHPhttps://im...

PT-2023-6140 · Raspap · Raspap

Name of the Vulnerable Software and Affected Versions: RaspAP versions 2.8.0 through 2.8.7 Description: A command injection issue allows unauthenticated attackers to execute arbitrary commands via the cfg id parameter in "/ajax/openvpn/activate ovpncfg.php" and "/ajax/openvpn/del ovpncfg.php". Th...

CVE-2023-26134

Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once...

Command injection

TOTOLink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the staticGw parameter at /setting/setWanIeCfg...

MGASA-2023-0189 Updated cups-filters packages fix security vulnerability

Possible command injection in the Backend Error Handler CVE-2023-24805...

CVE-2023-31530

Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the smartqosprioritydevices parameter...

PT-2023-3154 · Totolink · Totolink X18

Name of the Vulnerable Software and Affected Versions: TOTOLINK X18 version 9.1.0cu.2024 B20220329 Description: The issue is related to a command injection vulnerability in the setTracerouteCfg function, specifically via the command parameter. This vulnerability can be exploited by a remote...