Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f271c2e7-9d58-4dea-95d3-3ffc4ec7c3b2?source=cve - https://web.archive.org/web/20120712205339/https%3A//www.opensyscom.fr/Actualites/wordpress-plugins-front-end-editor-arbitrary-file-upload-vulnerability.html - https://packetstormsecurity.com/files/132303/ - https://www.cybersecurity-help.cz/vdb/SB2012070701 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=600233%40front-end-editor&old=569105%40front-end-editor&sfp_email=&sfph_mail=
CVE ID: CVE-2012-10020 State: PUBLISHED Published: 2025-07-22T01:44:29.019Z Last Updated: 2025-07-22T19:47:49.110Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WebMovementLLC Products: FoxyPress Problem Types: CWE-434 Description: The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/thre
code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8fbc88da-8944-433c-b94d-9604ffe13d8a?source=cve - https://packetstormsecurity.com/files/113576/ - https://web.archive.org/web/20210120060045/https%3A//www.securityfocus.com/bid/53805/info - https://plugins.trac.wordpress.org/changeset/555071 - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_foxypress_upload.rb
CVE ID: CVE-2012-10021 State: PUBLISHED Published: 2025-07-31T14:54:19.755Z Last Updated: 2025-11-20T21:28:06.069Z Vendors: D-Link Products: DIR-605L Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in D-Link DIR-605L Wireless N300 Cloud Router firmware versions 1.12 and 1.13 via the getAuthCode() function. The flaw arises from unsafe usage of sprintf() when processing user-supplied CAPTCHA data via the FILECODE parameter in /goform/formLogin. A remote unauthenticated attacker can exploit this to execute arbitrary code with root privileges on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/ra
ges on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb - https://web.archive.org/web/20121012062554/http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/ - https://www.exploit-db.com/exploits/29127 - https://forums.dlink.com/index.php?topic=51923.0 - https://www.vulncheck.com/advisories/dlink-dir605l-captcha-handling-stack-based-buffer-overflow
CVE ID: CVE-2012-10022 State: PUBLISHED Published: 2025-08-01T20:42:02.320Z Last Updated: 2025-08-06T13:58:30.060Z Vendors: LxCenter Products: Kloxo Problem Types: CWE-269 Description: Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user matches uid 48. This flaw enables attackers with Apache-level access to escalate privileges to root without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/mo
st Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/kloxo_lxsuexec.rb - https://www.exploit-db.com/exploits/25406 - https://web.archive.org/web/20121122063935/http://roothackers.net/showthread.php?tid=92 - https://kloxo.org/ - https://github.com/KloxoNGCommunity/kloxo - https://www.vulncheck.com/advisories/kloxo-local-priv-esc
CVE ID: CVE-2012-10023 State: PUBLISHED Published: 2025-08-05T20:02:08.874Z Last Updated: 2025-11-20T21:30:07.415Z Vendors: FreeFloat Products: FTP Server Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. The server fails to properly validate input passed to the USER command, allowing remote attackers to overwrite memory and potentially execute arbitrary code. The flaw is triggered by sending an overly long username string, which overflows the buffer allocated for user authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/
lyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/freefloatftp_user.rb - https://www.exploit-db.com/exploits/23243 - https://my.saintcorporation.com/cgi-bin/exploit_info/freefloat_ftp_server_user_cmd - https://www.exploit-db.com/exploits/15689 - https://web.archive.org/web/20101208040029/http://secunia.com/advisories/42465/ - https://web.archive.org/web/20101213050627/http://www.freefloat.com/sv/about-/about-.php - https://www.vulncheck.com/advisories/freefloat-ftp-server-user-command-buffer-overflow
CVE ID: CVE-2012-10024 State: PUBLISHED Published: 2025-08-05T20:07:06.342Z Last Updated: 2025-08-05T20:49:10.563Z Vendors: XBMC Products: Media Center Problem Types: CWE-22 Description: XBMC version 11, including builds up to the 2012-11-04 nightly release, contains a path traversal vulnerability in its embedded HTTP server. When accessed via HTTP Basic Authentication, the server fails to properly sanitize URI input, allowing authenticated users to request files outside the intended document root. An attacker can exploit this flaw to read arbitrary files from the host filesystem, including sensitive configuration or credential files. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
system, including sensitive configuration or credential files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ioactive.com/wp-content/uploads/pdfs/Security_Advisory_XBMC.pdf - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/gather/xbmc_traversal.rb - https://github.com/xbmc/xbmc/commit/bdff099c024521941cb0956fe01d99ab52a65335 - https://github.com/xbmc/xbmc - https://www.vulncheck.com/advisories/xbmc-web-server-path-traversal
CVE ID: CVE-2012-10025 State: PUBLISHED Published: 2025-08-05T20:06:00.838Z Last Updated: 2025-08-07T15:12:47.309Z Vendors: Advanced Custom Fields Products: WordPress Plugin Problem Types: CWE-98 Description: The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server’s context, allowing full compromise of the host. Additional Analyst Notes: -
remote code execution under the web server’s context, allowing full compromise of the host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_advanced_custom_fields_exec.rb - https://www.exploit-db.com/exploits/23856 - http://web.archive.org/web/20121223025326/http://secunia.com:80/advisories/51037 - https://www.tenable.com/plugins/nessus/63326 - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-custom-fields/advanced-custom-fields-351-remote-code-execution-via-remote-file-inclusion - https://wpscan.com/vulnerability/d132d93b-509c-490d-8001-8714
elds-351-remote-code-execution-via-remote-file-inclusion - https://wpscan.com/vulnerability/d132d93b-509c-490d-8001-87147ed28c5e/ - https://wordpress.org/plugins/advanced-custom-fields/ - https://www.vulncheck.com/advisories/wordpress-plugin-advanced-custom-fields-remote-file-inclusion
CVE ID: CVE-2012-10026 State: PUBLISHED Published: 2025-08-05T20:06:23.563Z Last Updated: 2025-11-22T16:31:31.329Z Vendors: Asset-Manager Products: Wordpress Plugin Problem Types: CWE-434 Description: The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context. Additional Analyst Notes: - CISA ADP Vulnrichm
quest, resulting in remote code execution under the web server’s context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb - https://www.exploit-db.com/exploits/18993 - https://www.exploit-db.com/exploits/23652 - http://web.archive.org/web/20150106144832/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html - https://wordpress.org/plugins/asset-manager/ - https://www.vulncheck.com/advisories/wordpress-plugin-asset-manager-php-file-upload
CVE ID: CVE-2012-10027 State: PUBLISHED Published: 2025-08-05T20:06:43.138Z Last Updated: 2025-11-22T16:31:48.081Z Vendors: WP-Property Products: WordPress Plugin Problem Types: CWE-434 Description: WP-Property plugin for WordPress through version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/wp-property/ - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_prope
p-property/ - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_property_upload_exec.rb - https://www.exploit-db.com/exploits/18987 - https://www.exploit-db.com/exploits/23651 - http://web.archive.org/web/20150103065650/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-wp-property-shell-upload-vulnerability.html - https://www.vulncheck.com/advisories/wordpress-plugin-wp-property-php-file-upload
CVE ID: CVE-2012-10028 State: PUBLISHED Published: 2025-08-05T20:04:20.181Z Last Updated: 2025-11-20T21:31:43.173Z Vendors: Netwin Products: SurgeFTP Problem Types: CWE-78 Description: Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to `surgeftpmgr.cgi`. This can lead to full remote code execution on the underlying system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/netwin_surgeftp_exec.rb - https://www.exploit-db.com/exploits/
7/metasploit-framework/master/modules/exploits/multi/http/netwin_surgeftp_exec.rb - https://www.exploit-db.com/exploits/23522 - https://www.exploit-db.com/exploits/23601 - https://netwinsite.com/surgeftp/ - https://www.vulncheck.com/advisories/netwin-surgeftp-auth-rce
CVE ID: CVE-2012-10029 State: PUBLISHED Published: 2025-08-05T20:03:35.395Z Last Updated: 2025-11-17T18:21:36.938Z Vendors: Nagios Enterprises Products: Nagios XI Graph Explorer Problem Types: CWE-78 Description: Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `visApi.php`. An authenticated user can inject system commands via unsanitized parameters such as `host`, resulting in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/nagios_graph_explorer.rb - https://www.exploit-db.com/exploits/2
etasploit-framework/master/modules/exploits/unix/webapp/nagios_graph_explorer.rb - https://www.exploit-db.com/exploits/23227 - https://packetstorm.news/files/id/118705/ - https://www.nagios.com/products/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-network-monitor-graph-explorer-component-auth-command-injection
CVE ID: CVE-2012-10030 State: PUBLISHED Published: 2025-08-05T20:01:46.446Z Last Updated: 2025-11-20T21:32:54.370Z Vendors: FreeFloat Products: FTP Server Problem Types: CWE-434, CWE-306, CWE-732 Description: FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server accepts empty credentials, defaults user access to the root of the C:\ drive, and imposes no restrictions on file type or destination path. These conditions enable attackers to upload executable payloads and .mof files to locations such as system32 and wbem\mof, where Windows Management Instrumentation (WMI) automa
ayloads and .mof files to locations such as system32 and wbem\mof, where Windows Management Instrumentation (WMI) automatically processes and executes them. This results in remote code execution with SYSTEM-level privileges, without requiring user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/freefloatftp_wbem.rb - https://www.exploit-db.com/exploits/23226 - https://www.fortiguard.com/encyclopedia/ips/34209/freefloat-ftp-server-arbitrary-file-upload - https://archive.org/details/tucows_367516_Freefloat_FTP_Server - https://www.vulncheck.com/advisories/freefloat-ft
oad - https://archive.org/details/tucows_367516_Freefloat_FTP_Server - https://www.vulncheck.com/advisories/freefloat-ftp-server-arbitrary-file-upload
CVE ID: CVE-2012-10031 State: PUBLISHED Published: 2025-08-05T20:00:15.915Z Last Updated: 2025-08-12T15:19:31.274Z Vendors: BlazeVideo Inc. Products: HDTV Player Pro Problem Types: CWE-121 Description: BlazeVideo HDTV Player Pro v6.6.0.3 is vulnerable to a stack-based buffer overflow due to improper handling of user-supplied input embedded in .plf playlist files. When parsing a crafted .plf file, the MediaPlayerCtrl.dll component invokes PathFindFileNameA() to extract a filename from a URL-like string. The returned value is then copied to a fixed-size stack buffer using an inline strcpy call without bounds checking. If the input exceeds the buffer size, this leads to a stack overflow and pot
inline strcpy call without bounds checking. If the input exceeds the buffer size, this leads to a stack overflow and potential arbitrary code execution under the context of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/blazedvd_hdtv_bof.rb - https://www.exploit-db.com/exploits/22931 - https://www.exploit-db.com/exploits/18693 - https://www.exploit-db.com/exploits/23052 - https://web.archive.org/web/20100302202333/https://blazevideo.com/help_center/hdtv-help/Technical-Support.html - https://www.vulncheck.com/advisories/blazevideo-hdtv-player-pro-filename-handli
enter/hdtv-help/Technical-Support.html - https://www.vulncheck.com/advisories/blazevideo-hdtv-player-pro-filename-handling-buffer-overflow
CVE ID: CVE-2012-10032 State: PUBLISHED Published: 2025-08-05T20:03:14.736Z Last Updated: 2025-08-07T13:58:54.181Z Vendors: Maxthon International Ltd. Products: Maxthon3 Browser Problem Types: CWE-79, CWE-94 Description: Maxthon3 versions prior to 3.3 are vulnerable to cross context scripting (XCS) via the about:history page. The browser’s trusted zone improperly handles injected script content, allowing attackers to execute arbitrary JavaScript in a privileged context. This flaw enables modification of browser configuration and execution of arbitrary code through Maxthon’s exposed DOM APIs, including maxthon.program.Program.launch() and maxthon.io.writeDataURL(). Exploitation requires user
exposed DOM APIs, including maxthon.program.Program.launch() and maxthon.io.writeDataURL(). Exploitation requires user interaction, typically by visiting a malicious webpage that triggers the injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/browser/maxthon_history_xcs.rb - https://www.exploit-db.com/exploits/23225 - http://blog.malerisch.net/2012/12/maxthon-cross-context-scripting-xcs-about-history-rce.html - https://www.maxthon.com/ - https://www.fortiguard.com/encyclopedia/ips/34203 - https://www.vulncheck.com/advisories/maxthon3-xcs-trusted-zone-code-exec
CVE ID: CVE-2012-10033 State: PUBLISHED Published: 2025-08-05T20:03:59.143Z Last Updated: 2025-08-06T15:16:27.531Z Vendors: Ångström Distribution Project Products: Narcissus Problem Types: CWE-78 Description: Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to sanitize the release parameter before passing it to the configure_image() function. This function invokes PHP’s passthru() with the unsanitized input, allowing attackers to inject arbitrary system commands. Exploitation occurs via a crafted POST request, resulting in command execution under the web server’s context. Additional An
oitation occurs via a crafted POST request, resulting in command execution under the web server’s context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/narcissus_backend_exec.rb - https://www.exploit-db.com/exploits/22709 - https://www.exploit-db.com/exploits/22856 - https://web.archive.org/web/20101127002623/https://narcissus.angstrom-distribution.org/ - https://www.vulncheck.com/advisories/narcissus-image-config-command-injection
CVE ID: CVE-2012-10034 State: PUBLISHED Published: 2025-08-05T20:00:40.834Z Last Updated: 2025-11-20T21:52:12.636Z Vendors: ClanSphere Project Products: ClanSphere Problem Types: CWE-22 Description: ClanSphere 2011.3 is vulnerable to a local file inclusion (LFI) flaw due to improper handling of the cs_lang cookie parameter. The application fails to sanitize user-supplied input, allowing attackers to traverse directories and read arbitrary files outside the web root. The vulnerability is further exacerbated by null byte injection (%00) to bypass file extension checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/clansphere_traversal.rb - https://www.exploit-db.com/exploits/22181 - https://sourceforge.net/projects/clansphere/ - https://www.vulncheck.com/advisories/clansphere-local-file-inclusion-via-cookie
CVE ID: CVE-2012-10035 State: PUBLISHED Published: 2025-08-05T20:05:31.584Z Last Updated: 2025-08-07T15:13:42.849Z Vendors: TurboSoft, Inc. Products: TurboFTP Server Problem Types: CWE-120 Description: Turbo FTP Server versions 1.30.823 and 1.30.826 contain a buffer overflow vulnerability in the handling of the PORT command. By sending a specially crafted payload, an unauthenticated remote attacker can overwrite memory structures and execute arbitrary code with SYSTEM privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/turboftp_port.rb - https://www.exploit-db.com/exploi
com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/turboftp_port.rb - https://www.exploit-db.com/exploits/22161 - https://www.vulncheck.com/advisories/turbo-ftp-server-port-command-buffer-overflow
CVE ID: CVE-2012-10036 State: PUBLISHED Published: 2025-08-08T18:12:12.901Z Last Updated: 2025-11-20T21:53:09.448Z Vendors: ProjectPier Products: ProjectPier Problem Types: CWE-434 Description: Project Pier 0.8.8 and earlier contains an unauthenticated arbitrary file upload vulnerability in tools/upload_file.php. The upload handler fails to validate the file type or enforce authentication, allowing remote attackers to upload malicious PHP files directly into a web-accessible directory. The uploaded file is stored with a predictable suffix and can be executed by requesting its URL, resulting in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw
ts URL, resulting in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/projectpier_upload_exec.rb - https://www.exploit-db.com/exploits/21929 - https://packetstorm.news/files/id/117070 - https://web.archive.org/web/20120111090432/http://www.projectpier.org/ - https://www.opensourcecms.com/projectpier/ - https://www.vulncheck.com/advisories/project-pier-arbitrary-file-upload-rce
CVE ID: CVE-2012-10037 State: PUBLISHED Published: 2025-08-11T14:54:16.517Z Last Updated: 2025-08-11T15:51:12.046Z Vendors: PhpTax Products: PhpTax Problem Types: CWE-78 Description: PhpTax version 0.8 contains a remote code execution vulnerability in drawimage.php. The pfilez GET parameter is unsafely passed to the exec() function without sanitization. A remote attacker can inject arbitrary shell commands, leading to code execution under the web server's context. No authentication is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/phptax_exec.rb - https://www.exploit-d
hubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/phptax_exec.rb - https://www.exploit-db.com/exploits/21665 - https://www.exploit-db.com/exploits/21833 - https://sourceforge.net/projects/phptax/
CVE ID: CVE-2012-10038 State: PUBLISHED Published: 2025-08-11T14:54:39.531Z Last Updated: 2025-08-11T15:51:43.803Z Vendors: Auxilium Products: RateMyPet Problem Types: CWE-434 Description: Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in upload_banners.php. The banner upload feature fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files. These files are stored in a web-accessible /banners/ directory and can be executed directly, resulting in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/mod
t Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/auxilium_upload_exec.rb - https://www.exploit-db.com/exploits/21329 - https://www.exploit-db.com/exploits/21836 - https://web.archive.org/web/20120331222419/http://www.auxiliumsoftware.com/
CVE ID: CVE-2012-10039 State: PUBLISHED Published: 2025-08-11T14:55:52.604Z Last Updated: 2025-11-20T21:56:02.362Z Vendors: ZEN Load Balancer Products: ZEN Load Balancer Problem Types: CWE-78 Description: ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi. The filelog parameter is passed directly into a backtick-delimited exec() call without sanitation. An authenticated attacker can inject arbitrary shell commands, resulting in remote code execution as the root user. ZEN Load Balancer is the predecessor of ZEVENET and SKUDONET. The affected versions (2.0 and 3.0-rc1) are no longer supported. SKUDONET CE is the current community-maintained s