6 results (0.006 seconds)

CVSS: 8.0EPSS: 0%CPEs: 4EXPL: 0

CVE-2023-25651 – SQL Injection Vulnerability in Some ZTE Mobile Internet Products

https://notcve.org/view.php?id=CVE-2023-25651

There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak. Existe una vulnerabilidad de inyección SQL en algunos productos de Internet móvil de ZTE. Debido a una validación de entrada insuficiente del parámetro de la interfaz SMS, un atacante autenticado podría utilizar la vulnerabilidad para ejecutar una inyección SQL y provocar una fuga de información. • https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032684 • CWE-20: Improper Input Validation CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2023-25649 – OS Command Injection Vulnerability in a Mobile Internet Product of ZTE

https://notcve.org/view.php?id=CVE-2023-25649

There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands. Existe una vulnerabilidad de inyección de comandos en un producto de Internet móvil de ZTE. Debido a la insuficiente validación del parámetro de interfaz SET_DEVICE_LED, un atacante autenticado podría utilizar la vulnerabilidad para ejecutar comandos arbitrarios. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ZTE MF286R routers. • https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032544 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •

CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1

CVE-2022-39073

https://notcve.org/view.php?id=CVE-2022-39073

There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary commands. Existe una vulnerabilidad de inyección de comandos en ZTE MF286R. Debido a una validación insuficiente de los parámetros de entrada, un atacante podría utilizar la vulnerabilidad para ejecutar comandos arbitrarios. • https://github.com/v0lp3/CVE-2022-39073 https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1028664 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •

CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0

CVE-2022-39072

https://notcve.org/view.php?id=CVE-2022-39072

There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks. • https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1028624 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1

CVE-2022-39066

https://notcve.org/view.php?id=CVE-2022-39066

There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection. Existe una vulnerabilidad de inyección SQL en ZTE MF286R. Debido a una validación insuficiente de los parámetros de entrada de la interfaz de la agenda telefónica, un atacante autenticado podría utilizar la vulnerabilidad para ejecutar una inyección SQL arbitraria. • https://github.com/v0lp3/CVE-2022-39066 https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1027744 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •