CVE-2021-31630

CVE-2021-31630 OpenPLC 3 WebServer Authenticated Remote Code Execution. Описание Наличие внедрения команд Command Injection в веб-сервере Open PLC v3 позволяет удалённым злоумышленникам выполнять произвольный код. Протестировано только на машине HTB Wifinetictwo.htb. Я обнаружил проблемы со всеми...

CVE-2002-0288

CVE-2002-0288 Phusion WebServer 1.0 - Traversée de répertoire 1 Publication sur Exploit-db à https://www.exploit-db.com/exploits/21291/ CVE-2002-0288 Phusion WebServer 1.0 - Traversée de répertoire 2 Publication sur Exploit-db à https://www.exploit-db.com/exploits/21292/ Auteur Alex Hernandez ali...

CVE-2026-54674

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2026-54674 Authenticated Command Injection in FreePBX UCP Interface

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2026-54674 Authenticated Command Injection in FreePBX UCP Interface

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2026-54674

The FreePBX open source IP PBX is vulnerable to authenticated command injection in the User Control Panel (UCP) interface prior to versions 16.0.39 and 17.0.7 . The root cause is insufficient sanitization of specific URL parameters, which allows an authenticated user to execute arbitrary commands...

CVE-2022-39073

CVE-2022-39073 Détails du firmware : wainnerversion: BDPOSTEMF286RMODULEV1.0.0B12 crversion: CRITPOSTEMF286RV1.0.0B10 Prérequis requests pip install requests Injection de commande La vulnérabilité est une injection de commande partagée entre le binaire ztenetlinkdetect et le gestionnaire...

CVE-2026-54674: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2021-31630-OpenPLC-3-Authenticated-RCE

CVE-2021-31630 Exécution de code à distance authentifiée sur le serveur web OpenPLC 3. Description La présence d'une injection de commandes dans Open PLC Webserver v3 permet à des attaquants distants d'exécuter du code arbitraire en exploitant le composant « Hardware Layer Code Box » présent sur ...

CVE-2024-4577_Analysis

Analyse de CVE-2024-4577 Ci-dessus se trouve mon rapport d'analyse, et il y a également des informations sur : - Configuration du serveur web Apache - Débogueur pour PHP Documents pour mon rapport : https://nvd.nist.gov/vuln/detail/CVE-2024-4577...

CVE-2026-100669: Improper Handling of Case Sensitivity

Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config IIS, every deny rule usersensitivefolders, useraccounts, userdata, usererrorredirect, userpages, system, vendor, ignorefolders sets...

CVE-2026-94214

A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack...

CVE-2026-94216

An open redirect vulnerability affects ST Engineering iDirect Evolution and Velocity WebServer Evolution (up to build 20260717). The flaw resides in the authorize function of the file /usr/sbin/webserver, specifically in the HTTP Header Handler component. Manipulating the Success argument allows ...

EUVD-2026-83907

A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This vulnerability affects the function authorize of the file /usr/sbin/webserver of the component HTTP Header Handler. Executing a manipulation of the argument Success can lead to...

CVE-2026-94214 ST Engineering iDirect Evolution/Velocity WebServer Evolution Location Header redirect

A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack...

CVE-2026-94214 ST Engineering iDirect Evolution/Velocity WebServer Evolution Location Header redirect

A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack...

EUVD-2026-83902

A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the file /login.html of the component Management Service. Performing a manipulation of the argument Host results in open redirect. It is possible to...

CVE-2026-94214

ST Engineering iDirect Evolution and Velocity WebServer Evolution (versions up to 20260717 ) contain an open redirect vulnerability in the Management Service component, specifically in the /login.html file. The root cause is unsanitized manipulation of the Host argument, allowing a remote attacke...

PT-2026-96089

Name of the Vulnerable Software and Affected Versions ST Engineering iDirect Evolution versions prior to 20260717 Velocity WebServer Evolution versions prior to 20260717 Description An open redirect issue exists in the Management Service component within the /login.html file. A remote attacker ca...

CVE-2026-94214: URL Redirection to Untrusted Site

A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the file /login.html of the component Management Service. Performing a manipulation of the argument Host results in open redirect. It is possible to...