D-Link DNS-320 operating system command injection vulnerability

The D-Link DNS-320 is a dual-disk entry-level NAS network storage device launched by D-Link. The D-Link DNS-320 has an operating system command injection vulnerability. This vulnerability stems from the chown function in webfilemgr.cgi, which fails to properly filter user input. Currently, no...

CVE-2026-8272: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfilemgr.cgi. The manipulation results in os command injection. The attack may be performed from remote. The exploit has been released to the public...

Command injection

Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution as root, starting from a low-privilege user session vulnerability. The cgi-bin/webfilemgr.cgi file allows arbitrary file write by...

CVE-2019-9949: Improper Link Resolution Before File Access

Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution as root, starting from a low-privilege user session vulnerability. The cgi-bin/webfilemgr.cgi file allows arbitrary file write by...