CVE-2022-25076

CVE-2022-25076 affects TOTOLink A800R firmware 4.1.2cu.5137_B20200730. The root cause is lack of input sanitization in the Main function, enabling command injection via the QUERY_STRING parameter. Impact is high/critical with potential remote command execution (network access, no auth, no user in...

CVE-2022-25075

CVE-2022-25075 affects TOTOLink A3000RU (V5.9c.2280_B20180512). A command‑injection vulnerability in the "Main" function allows execution of arbitrary commands via the QUERY_STRING parameter. Multiple sources (NVD, CNVD, CVE lists, vendor advisories) corroborate the flaw and its impact, which is ...

CVE-2022-23848

In CVE-2022-23848, Alluxio before 2.7.3 does not validate the input stream in the logserver, which could allow malformed data handling to affect logging behavior or control flow. The NVD metrics indicate a high-severity, network-exposed issue with potential impact to confidentiality, integrity, a...

CVE-2022-25134

The CVE-2022-25134 entry details a command injection vulnerability in the TOTOLINK T6 router. The flaw exists in the function setUpgradeFW of the T6_V3 firmware (V3_Firmware T6_V3_V4.1.5cu.748_B20211015). An attacker can trigger the vulnerability by sending a crafted MQTT packet , enabling arbitr...

CVE-2022-0543

CVE-2022-0543 concerns Redis with a Debian-specific Lua sandbox escape packaging issue that can lead to remote code execution. The vulnerability is described as a Debian packaging problem in Redis, enabling a sandbox escape and potential arbitrary code execution on affected systems. Public adviso...

CVE-2022-25335

RigoBlock Dragos through 2022-02-17 is affected by a vulnerability caused by the absence of the onlyOwner modifier on setMultipleAllowances. This enables token manipulation, with in-the-wild exploitation reported in February 2022. The vulnerability is slated for remediation only via a major proto...

CVE-2022-25322

CVE-2022-25322 affects ZEROF Web Server 2.0, where the endpoint /HandleEvent is vulnerable to SQL Injection . The NVD/NVD-derived metrics list CVSS v3.1 base score 9.8 (CRITICAL) and CVSS v2 base 7.5 (HIGH);攻击面 is NETWORK with low complexity and no authentication. Connected sources describe explo...

CVE-2021-45382

CVE-2021-45382 affects D-Link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers. The vulnerability is a Remote Command Execution via the DDNS function in the ncc2 binary, allowing unauthenticated command execution and potentially full router compromise. The issue is described as a c...

CVE-2022-0633

CVE-2022-0633 concerns the UpdraftPlus WordPress plugin. Affected: UpdraftPlus Free < 1.22.3 and Premium

CVE-2021-44868

The vulnerability CVE-2021-44868 affects Ming-soft MCMS v5.1. A SQL injection flaw exists in the /ms/cms/content/list.do endpoint, enabling potentially unauthorized access to backend data. Documented under CVSS metrics, the issue has a CVSS v3.1 base score of 9.8 (CRITICAL) with NETWORK attack ve...

CVE-2022-24086

CVE-2022-24086 affects Adobe Commerce and Magento Open Source via an improper input validation vulnerability during checkout, allowing arbitrary code execution without user interaction. Affected: Adobe Commerce 2.4.3-p1 and earlier, 2.3.7-p2 and earlier. Evidence from multiple advisories confirms...

CVE-2022-24663

CVE-2022-24663 affects the WordPress PHP Everywhere plugin (versions

CVE-2022-24665

CVE-2022-24665 affects the WordPress PHP Everywhere plugin

CVE-2022-24664

CVE-2022-24664 affects the WordPress PHP Everywhere plugin. Vulnerable in versions

CVE-2021-3560

CVE-2021-3560 – Polkit local privilege escalation : A flaw in polkit allows a local unprivileged process to bypass credential checks for D-Bus requests, enabling privilege escalation to root. Technical details across connected sources show the issue arises when a requesting process disconnects fr...

CVE-2021-45420

Emerson Dixell XWEB-500 devices are affected by an unauthenticated arbitrary file-write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. Exploitation allows writing arbitrary files to the target system, with potential denial of service and remote ...

CVE-2021-4102

CVE-2021-4102 is a use-after-free vulnerability in Google Chrome’s V8 engine. Affected component: V8 within Chrome prior to version 96.0.4664.110. Root cause: use-after-free that could enable heap corruption via a crafted HTML page. Impact: remote code execution with high severity (per CVSS metri...

CVE-2022-0185

CVE-2022-0185 is a Linux kernel vulnerability in the legacy_parse_param path of the Filesystem Context API. It is a heap-based buffer overflow in parameter length verification that can be triggered by an unprivileged local user when opening a filesystem that falls back to legacy handling, enablin...

CVE-2022-24112

CVE-2022-24112 affects Apache APISIX. It arises from the batch-requests plugin, where a bug can bypass the Admin API IP restriction, enabling remote code execution. Exploits/PoCs exist for APISIX 2.12.0–2.12.1 demonstrating RCE via admin API path and Lua code injection in routes, with documented ...

CVE-2022-20699

CVE-2022-20699 affects Cisco Small Business RV160/RV260/RV340/RV345 Series Routers. The available connected materials indicate a stack-based buffer overflow in the RV340 SSL VPN functionality, leading to unauthenticated remote code execution with root-level impact on the device. Metasploit also d...