CVE-2023-33318 | CRITICAL | 9.9 | 0.00814 | 39.88 | No | No | 2023-12-20 | 2026-04-28 | euvd | Unrestricted Upload of File with Dangerous Type vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.…Unrestricted Upload of File with Dangerous Type vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.40. |
CVE-2022-2302 | CRITICAL | 9.8 | 0.0195 | 39.88 | No | No | 2022-07-11 | 2024-09-16 | euvd | Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the devic…Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote attacker can get full access without knowledge of the password. |
CVE-2024-24790 | CRITICAL | 9.8 | 0.01952 | 39.88 | No | No | 2024-06-05 | 2025-02-13 | euvd | The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses w…The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. |
CVE-2025-50756 | CRITICAL | 9.8 | 0.01948 | 39.88 | No | No | 2025-07-14 | 2025-07-16 | euvd | Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the newpass parameter. This …Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the newpass parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. |
CVE-2022-40628 | CRITICAL | 9.8 | 0.01933 | 39.88 | No | No | 2022-09-23 | 2025-05-22 | euvd | This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (in…This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper control of code generation in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands on the targeted device. |
CVE-2023-24139 | CRITICAL | 9.8 | 0.01946 | 39.88 | No | No | 2023-02-03 | 2025-03-26 | euvd | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag…TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag function. |
CVE-2023-24141 | CRITICAL | 9.8 | 0.01946 | 39.88 | No | No | 2023-02-03 | 2025-03-26 | cnvd, euvd | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetw…TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetworkDiag function. |
CVE-2023-32222 | CRITICAL | 9.8 | 0.01945 | 39.88 | No | No | 2023-06-28 | 2024-11-27 | euvd | D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method.D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method. |
CVE-2026-41096 | CRITICAL | 9.8 | 0.01932 | 39.88 | No | No | 2026-05-12 | 2026-08-10 | euvd | Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network. |
CVE-2021-29089 | CRITICAL | 9.8 | 0.01929 | 39.88 | No | No | 2021-06-02 | 2024-09-16 | euvd | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo …Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors. |
CVE-2022-41267 | CRITICAL | 9.9 | 0.00791 | 39.88 | No | No | 2022-12-13 | 2025-04-22 | euvd | SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Busin…SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server at the operating system level, enabling the attacker to take full control of the system causing a high impact on confidentiality, integrity, and availability of the application. |
CVE-2023-24140 | CRITICAL | 9.8 | 0.01946 | 39.88 | No | No | 2023-02-03 | 2025-03-26 | euvd | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkD…TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function. |
CVE-2024-24321 | CRITICAL | 9.8 | 0.01937 | 39.88 | No | No | 2024-02-08 | 2026-07-09 | euvd | An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_4…An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function. |
CVE-2022-31031 | CRITICAL | 9.8 | 0.01931 | 39.88 | No | No | 2022-06-07 | 2025-11-04 | euvd | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD…PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their applications, either by: setting a STUN server in their account/media config in PJSUA/PJSUA2 level, or directly using `pjlib-util/stun_simple` API. A patch is available in commit 450baca which should be included in the next release. There are no known workarounds for this issue. |
CVE-2021-23376 | CRITICAL | 9.8 | 0.01943 | 39.88 | No | No | 2021-04-18 | 2024-09-17 | euvd | This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for a…This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. |
CVE-2025-0364 | CRITICAL | 9.8 | 0.0193 | 39.88 | No | No | 2025-02-04 | 2026-05-14 | euvd | BigAntSoft BigAnt Server, up to and including version 5.6.06, is vulnerable to unauthenticated remote code execution via account registratio…BigAntSoft BigAnt Server, up to and including version 5.6.06, is vulnerable to unauthenticated remote code execution via account registration. An unauthenticated remote attacker can create an administrative user through the default exposed SaaS registration mechanism. Once an administrator, the attacker can upload and execute arbitrary PHP code using the "Cloud Storage Addin," leading to unauthenticated code execution. |
CVE-2023-38647 | CRITICAL | 9.8 | 0.01953 | 39.88 | No | No | 2023-07-26 | 2024-10-02 | euvd | An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax…An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run in Helix REST start and Workflow creation.
Affect all the versions lower and include 1.2.0.
Affected products: helix-core, helix-rest
Mitigation: Short term, stop using any YAML based configuration and workflow creation.
Long term, all Helix version bumping up to 1.3.0 |
CVE-2023-24142 | CRITICAL | 9.8 | 0.01946 | 39.88 | No | No | 2023-02-03 | 2025-03-26 | euvd | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetwork…TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetworkDiag function. |
CVE-2023-24154 | CRITICAL | 9.8 | 0.01946 | 39.88 | No | No | 2023-02-03 | 2025-03-26 | euvd | TOTOLINK T8 V4.1.5cu was discovered to contain a command injection vulnerability via the slaveIpList parameter in the function setUpgradeFW.TOTOLINK T8 V4.1.5cu was discovered to contain a command injection vulnerability via the slaveIpList parameter in the function setUpgradeFW. |
CVE-2020-16096 | CRITICAL | 9.9 | 0.008 | 39.88 | No | No | 2020-09-15 | 2024-08-04 | euvd | In Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5), 7.90 prior to 7.90.991(MR5), 7.80 prior to …In Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5), 7.90 prior to 7.90.991(MR5), 7.80 prior to 7.80.960(MR2), 7.70 and earlier, any operator account has access to all data that would be replicated if the system were to be (or is) attached to a multi-server environment. This can include plain text credentials for DVR systems and card details used for physical access/alarm/perimeter components. |
CVE-2020-6152 | CRITICAL | 9.8 | 0.01943 | 39.88 | No | No | 2020-09-01 | 2024-08-04 | euvd | A code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A specially crafted malfo…A code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A specially crafted malformed file can cause an out-of-bounds write. An attacker can trigger this vulnerability by providing a victim with a malicious DICOM file. |
CVE-2024-0455 | CRITICAL | 9.9 | 0.00813 | 39.88 | No | No | 2024-02-25 | 2024-08-12 | euvd | The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when in single…The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when in single user) could put in the URL
```
http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance
```
which is a special IP and URL that resolves only when the request comes from within an EC2 instance. This would allow the user to see the connection/secret credentials for their specific instance and be able to manage it regardless of who deployed it.
The user would have to have pre-existing knowledge of the hosting infra which the target instance is deployed on, but if sent - would resolve if on EC2 and the proper `iptable` or firewall rule is not configured for their setup. |
CVE-2024-31818 | CRITICAL | 9.8 | 0.01949 | 39.88 | No | No | 2024-04-12 | 2024-08-02 | euvd | Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.p…Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.php component. |
CVE-2021-23378 | CRITICAL | 9.8 | 0.01943 | 39.88 | No | No | 2021-04-18 | 2024-09-16 | euvd | This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker…This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. |
CVE-2023-32014 | CRITICAL | 9.8 | 0.01943 | 39.88 | No | No | 2023-06-13 | 2025-01-01 | euvd | Windows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityWindows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability |
CVE-2020-7724 | CRITICAL | 9.8 | 0.01916 | 39.87 | No | No | 2020-09-01 | 2024-09-16 | euvd | All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function.All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function. |
CVE-2023-49742 | CRITICAL | 9.9 | 0.00768 | 39.87 | No | No | 2024-04-18 | 2026-04-28 | euvd | Missing Authorization vulnerability in Support Genix.This issue affects Support Genix: from n/a through 1.2.3.Missing Authorization vulnerability in Support Genix.This issue affects Support Genix: from n/a through 1.2.3. |
CVE-2021-32534 | CRITICAL | 9.8 | 0.01924 | 39.87 | No | No | 2021-07-07 | 2024-09-17 | euvd | QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbi…QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0. |
CVE-2023-24146 | CRITICAL | 9.8 | 0.01915 | 39.87 | No | No | 2023-02-03 | 2025-03-26 | euvd | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg fu…TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg function. |
CVE-2021-32810 | CRITICAL | 9.8 | 0.01923 | 39.87 | No | No | 2021-08-02 | 2024-08-03 | euvd | crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0…crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4. |
CVE-2020-7725 | CRITICAL | 9.8 | 0.01916 | 39.87 | No | No | 2020-09-01 | 2024-09-16 | euvd | All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function.All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function. |
CVE-2020-7723 | CRITICAL | 9.8 | 0.01916 | 39.87 | No | No | 2020-09-01 | 2024-09-16 | euvd | All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function.All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function. |
CVE-2022-3682 | CRITICAL | 9.9 | 0.00781 | 39.87 | No | No | 2023-03-28 | 2025-02-18 | euvd | A vulnerability exists in the SDM600 file permission validation.
An attacker could exploit the vulnerability by gaining access to the syste…A vulnerability exists in the SDM600 file permission validation.
An attacker could exploit the vulnerability by gaining access to the system and uploading a specially crafted message to the system node, which could result in Arbitrary code Executing.
This issue affects: All SDM600 versions prior to version 1.2 FP3 HF4 (Build Nr. 1.2.23000.291)
List of CPEs:
* cpe:2.3:a:hitachienergy:sdm600:1.0:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.1:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.9002.257:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.10002.257:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.11002.149:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.12002.222:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.13002.72:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.14002.44:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.14002.92:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.14002.108:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.14002.182:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.14002.257:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.14002.342:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.14002.447:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.14002.481:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.14002.506:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.14002.566:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.20000.3174:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.21000.291:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.21000.931:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.21000.105:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:sdm600:1.2.23000.291:*:*:*:*:*:*:* |
CVE-2023-23970 | CRITICAL | 9.9 | 0.00785 | 39.87 | No | No | 2023-12-20 | 2026-04-28 | euvd | Unrestricted Upload of File with Dangerous Type vulnerability in WooRockets Corsa.This issue affects Corsa: from n/a through 1.5.Unrestricted Upload of File with Dangerous Type vulnerability in WooRockets Corsa.This issue affects Corsa: from n/a through 1.5. |
CVE-2025-61304 | CRITICAL | 9.8 | 0.01917 | 39.87 | No | No | 2025-11-05 | 2025-11-05 | euvd | OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address.OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address. |
CVE-2025-29384 | CRITICAL | 9.8 | 0.01907 | 39.87 | No | No | 2025-03-14 | 2025-03-19 | euvd | In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to …In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution. |
CVE-2025-22912 | CRITICAL | 9.8 | 0.01917 | 39.87 | No | No | 2025-01-16 | 2026-07-07 | euvd | RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept.RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept. |
CVE-2018-6334 | CRITICAL | 9.8 | 0.01913 | 39.87 | No | No | 2018-12-31 | 2025-05-06 | euvd | Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly …Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly before being used this can lead to unexpected behavior. This affects all supported versions of HHVM prior to the patch (3.25.1, 3.24.5, and 3.21.9 and below). |
CVE-2020-7721 | CRITICAL | 9.8 | 0.01916 | 39.87 | No | No | 2020-09-01 | 2024-09-16 | euvd | All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function.All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function. |
CVE-2023-26848 | CRITICAL | 9.8 | 0.0192 | 39.87 | No | No | 2023-04-07 | 2025-02-12 | euvd | TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStat…TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStaticDhcpRules. |
CVE-2023-26978 | CRITICAL | 9.8 | 0.0192 | 39.87 | No | No | 2023-04-07 | 2025-02-12 | euvd | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting…TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting/setWanIeCfg. |
CVE-2021-32533 | CRITICAL | 9.8 | 0.01924 | 39.87 | No | No | 2021-07-07 | 2024-09-16 | euvd | The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary …The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0. |
CVE-2020-7718 | CRITICAL | 9.8 | 0.01916 | 39.87 | No | No | 2020-09-01 | 2024-09-16 | euvd | All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions. |
CVE-2023-2834 | CRITICAL | 9.8 | 0.01914 | 39.87 | No | No | 2023-06-30 | 2026-04-08 | euvd | The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient …The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. |
CVE-2024-34204 | CRITICAL | 9.8 | 0.019 | 39.87 | No | No | 2024-05-09 | 2025-02-13 | cnvd, euvd | TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW function v…TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. |
CVE-2026-26142 | CRITICAL | 9.8 | 0.01914 | 39.87 | No | No | 2026-06-09 | 2026-08-14 | euvd, nvd | Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network.Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network. |
CVE-2024-31822 | CRITICAL | 9.8 | 0.01919 | 39.87 | No | No | 2024-04-29 | 2024-08-02 | euvd | An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary…An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the saveLanguageFiles method of the Languages.php component. |
CVE-2020-13572 | CRITICAL | 9.8 | 0.01917 | 39.87 | No | No | 2021-02-10 | 2024-08-04 | euvd | A heap overflow vulnerability exists in the way the GIF parser decodes LZW compressed streams in Accusoft ImageGear 19.8. A specially crafte…A heap overflow vulnerability exists in the way the GIF parser decodes LZW compressed streams in Accusoft ImageGear 19.8. A specially crafted malformed file can trigger a heap overflow, which can result in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. |
CVE-2017-2877 | CRITICAL | 9.8 | 0.01902 | 39.87 | No | No | 2018-09-19 | 2024-09-17 | euvd | A missing error check exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A …A missing error check exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted request on port 10001 could allow an attacker to reset the user accounts to factory defaults, without authentication. |
CVE-2022-36276 | CRITICAL | 9.9 | 0.00768 | 39.87 | No | No | 2023-10-04 | 2024-09-05 | euvd | TCMAN GIM v8.0.1 is vulnerable to a SQL injection via the 'SqlWhere' parameter inside the function 'BuscarESM'. The exploitation of this vul…TCMAN GIM v8.0.1 is vulnerable to a SQL injection via the 'SqlWhere' parameter inside the function 'BuscarESM'. The exploitation of this vulnerability might allow a remote attacker to directly interact with the database. |