CVSS: 6.3EPSS: 0%CPEs: -EXPL: 0CVE-2024-39209
https://notcve.org/view.php?id=CVE-2024-39209
luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter. • https://gist.github.com/yanggao017/e392a633b8cee6f42c514b125860081c https://github.com/yanggao017/vuln/blob/main/luci-app-sms-tool.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.3EPSS: 0%CPEs: -EXPL: 0CVE-2023-26877
https://notcve.org/view.php?id=CVE-2023-26877
File upload vulnerability found in Softexpert Excellence Suite v.2.1 allows attackers to execute arbitrary code via a .php file upload to the form/efms_exec_html/file_upload_parser.php endpoint. Vulnerabilidad de carga de archivos encontrada en Softexpert Excellence Suite v.2.1 permite a atacantes ejecutar código arbitrario mediante la carga de un archivo .php al endpoint form/efms_exec_html/file_upload_parser.php. • https://gist.github.com/rodnt/90ac26fdf891e602f6f090d6aebce32d • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 2.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37253 – WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability
https://notcve.org/view.php?id=CVE-2024-37253
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code Injection.This issue affects WP Directory Kit: from n/a through 1.3.6. Neutralización incorrecta de elementos especiales en la salida utilizados por una vulnerabilidad de componente posterior ("Injection") en WpDirectoryKit WP Directory Kit permite la inyección de código. Este problema afecta a WP Directory Kit: desde n/a hasta 1.3.6. The WP Directory Kit plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.3.6. This is due to improper sanitization and escaping on a value. • https://patchstack.com/database/vulnerability/wpdirectorykit/wordpress-wpdirectorykit-plugin-1-3-2-html-injection-vulnerability?_s_id=cve • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-6206
https://notcve.org/view.php?id=CVE-2024-6206
The core application contains a code injection vulnerability where a threat actor could execute arbitrary commands with the privilege of the underlying container leading to complete takeover of the target system. • https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04659en_us&docLocale=en_US • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4884 – WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-4884
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The Apm.UI.Areas.APM.Controllers.CommunityController allows execution of commands with iisapppool\nmconsole privileges. En las versiones de WhatsUp Gold lanzadas antes de 2023.1.3, se detectó una vulnerabilidad de ejecución remota de código no autenticada en WhatsUpGold en curso. Apm.UI.Areas.APM.Controllers.CommunityController permite la ejecución de comandos con privilegios de iisapppool\nmconsole. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 https://www.progress.com/network-monitoring • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •