Exploit for OS Command Injection in Raisecom Msg2300_Firmware

This is a PoC exploit for CVE-2024-7120, a vulnerability in an u...

CVE-2025-2771

CVE-2025-2771 concerns BEC Technologies routers with an authentication bypass in the web-based UI, allowing remote attackers to access functionality without credentials. The vulnerability stems from lack of authentication prior to accessing UI functions. Connected sources (ZDI advisory ZDI-25-184...

The vulnerability of the doUpdate function in the web interface of TP-Link’s router software, TL-WR841N, allows a hacker to inject any JavaScript code.

The vulnerability of the doUpdate function in the web interface of TP-Link’s router software, the TL-WR841N, is related to a deficiency in the upnpTbl filter parameter when accessing the UPnP.html web page. Exploiting this vulnerability allows an attacker to inject arbitrary JavaScript code by...

CVE-2025-25427

A stored cross-site scripting XSS vulnerability in the upnp.htm page of the web Interface in TP-Link WR841N v14/v14.6/v14.8 = Build 241230 Rel. 50788n allows remote attackers to inject arbitrary JavaScript code via the port mapping description. This leads to an execution of the JavaScript payload...

CVE-2024-41788

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager All versions. The web interface of affected devices does not sanitize the input parameters in specific GET requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges...

The vulnerability in the web interface for managing Tenda FH1202 micro-program software routers allows a hacker to escalate their privileges.

The vulnerability of the web interface for managing Tenda FH1202 micro-programming software routers is related to deficiencies in access control when processing the /goform/qossetting endpoint. Exploiting this vulnerability allows a malicious actor to enhance their privileges by sending specially...

CVE-2024-41795

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager All versions. The web interface of affected devices is vulnerable to Cross-Site Request Forgery CSRF attacks. This could allow an unauthenticated attacker to change arbitrary device settings by tricking a legitimate device...

CVE-2024-41790

CVE-2024-41790 affects Siemens SENTRON 7KT PAC1260 Data Manager (all versions). The issue is an OS command injection stemming from improper handling of the region parameter in specific POST requests to the device’s web interface, allowing an authenticated remote attacker to execute arbitrary comm...

CVE-2024-41788

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager All versions. The web interface of affected devices does not sanitize the input parameters in specific GET requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges...

The vulnerability in the web interface of the Cisco Prime Infrastructure monitoring and management system, as well as the Cisco Evolved Programmable Network Manager (EPNM) software for managing network services, allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the web interface for managing Cisco Prime Infrastructure network equipment and the Cisco Evolved Programmable Network Manager EPNM software lies in the insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to perform...

The vulnerability of the web interface of the “Central Archive of Medical Images” information system, which stems from the lack of protective measures for the website structure, allows attackers to gain unauthorized access to the protected information.

The vulnerability of the web interface of the “Central Archive of Medical Images” information system is related to the lack of protective measures for the website structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the protected...

The vulnerability in the web interface for managing micro-program software on Cisco Expressway allows a hacker to redirect users to any arbitrary URL address.

The vulnerability of the web interface for managing microprogramming software in Cisco Expressway is related to the use of open redirection. Exploiting this vulnerability allows a malicious actor to redirect users to any arbitrary URL address...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload arbitrary files, increase their privileges, and execute arbitrary commands.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform relates to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to load arbitrary files, increase their privileges, and execute arbitrary commands...

CVE-2024-54806

Netgear WNR854T 1.5.2 North America is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system commands via the web interface...

The vulnerability of the ADI web interface of the Verve Asset Manager software allows a perpetrator to execute arbitrary commands within the context of the Agentless Device Inventory.

The vulnerability of the ADI web interface of the Verve Asset Manager software solution is related to the failure to take measures to neutralize certain special elements. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary commands within the...

The vulnerability of the web interface of Moxa network device software for models EDF-G1002-BP, EDR-810, EDR-8010, EDR-G9004, EDR-G9010, NAT-102, TN-4900, and OnCell G4302-LTE4 allows a perpetrator to execute arbitrary commands through NTP settings, thereby gaining full control over the device.

The vulnerability of the web interface of Moxa network devices of the EDF-G1002-BP, EDR-810, EDR-8010, EDR-G9004, EDR-G9010, NAT-102, TN-4900, and OnCell G4302-LTE4 series is related to the lack of measures to neutralize specific components. Exploiting this vulnerability allows a malicious actor ...

The vulnerability in the web interface of Netgear WNR854T router software allows a hacker to execute arbitrary commands and gain full control over the device.

The vulnerability of the web interface of Netgear WNR854T router software lies in the lack of measures to neutralize special elements used in the operating system’s commands when processing the wanhostname parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

CVE-2025-27405

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of tha...

(0Day) BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the web-based user interface. The issue results from storing credentials in...

(0Day) BEC Technologies Multiple Routers Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of BEC Technologies routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web-based user interface. The issue results from the lack of authentication...