Page 3 of 11 results (0.001 seconds)

CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0

An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized. • https://r.sec-consult.com/imageaccess https://www.imageaccess.de/?page=SupportPortal&lang=en • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •