deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5376
Published: 2024-05-26
Description: A vulnerability was found in Kashipara College Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file view_each_faculty.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266288.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System%20-%20xss/College%20Management%20System%20-%20vuln%2010.pdf; https://vuldb.com/?ctiid.266288; https://vuldb.com/?id.266288
CVE: CVE-2024-5377
Published: 2024-05-26
Description: A vulnerability was found in SourceCodester Vehicle Management System 1.0. It has been classified as critical. This affects an unknown part of the file /newvehicle.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266289 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-434
References: https://github.com/yuyuliq/cve/issues/1; https://vuldb.com/?ctiid.266289; https://vuldb.com/?id.266289
CVE: CVE-2024-34454
Published: 2024-05-26
Description: Nintendo Wii U OS 5.5.5 allows man-in-the-middle attackers to forge SSL certificates as though they came from a Root CA, because there is a secondary verification mechanism that only checks whether a CA is known and ignores the CA details and signature (and because * is accepted as a Common Name).
CVSS Score: 7.4 (HIGH)
CWE: CWE-269
References: https://github.com/PretendoNetwork/SSSL; https://github.com/PretendoNetwork/SSSL-DNS; https://github.com/PretendoNetwork/SSSL
CVE: CVE-2024-5378
Published: 2024-05-26
Description: A vulnerability was found in SourceCodester School Intramurals Student Attendance Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /manage_sy.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-266290 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/GAO-UNO/cve/blob/main/sql2.md; https://vuldb.com/?ctiid.266290; https://vuldb.com/?id.266290
CVE: CVE-2024-5379
Published: 2024-05-26
Description: A vulnerability was found in JFinalCMS up to 20240111. It has been rated as problematic. This issue affects some unknown processing of the file /admin/template. The manipulation of the argument directory leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266291.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/heyewei/JFinalcms/issues/I8VHGR; https://vuldb.com/?ctiid.266291; https://vuldb.com/?id.266291
CVE: CVE-2024-36054
Published: 2024-05-26
Description: Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily read kernel memory (and consequently gain all privileges) via IOCTL 0x9c4064b8 (via MmMapIoSpace) and IOCTL 0x9c406490 (via ZwMapViewOfSection).
CVSS Score: 7.4 (HIGH)
CWE: CWE-125
References: https://www.marvintest.com/Downloads.aspx?prodId=12&search=package; https://www.marvintest.com/KnowledgeBase/KBArticle.aspx?ID=362; https://www.marvintest.com/Downloads.aspx?prodId=12&search=package
CVE: CVE-2024-36055
Published: 2024-05-26
Description: Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory with read/write access via the MmMapIoSpace API (IOCTL 0x9c40a4f8, 0x9c40a4e8, 0x9c40a4c0, 0x9c40a4c4, 0x9c40a4ec, and seven others), leading to a denial of service (BSOD).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://www.marvintest.com/Downloads.aspx?prodId=12&search=package; https://www.marvintest.com/KnowledgeBase/KBArticle.aspx?ID=362; https://www.marvintest.com/Downloads.aspx?prodId=12&search=package
CVE: CVE-2024-36056
Published: 2024-05-26
Description: Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory via IOCTL 0x9c406490 (for IoAllocateMdl, MmBuildMdlForNonPagedPool, and MmMapLockedPages), leading to NT AUTHORITY\SYSTEM privilege escalation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-269
References: https://www.marvintest.com/Downloads.aspx?prodId=12&search=package; https://www.marvintest.com/KnowledgeBase/KBArticle.aspx?ID=362; https://www.marvintest.com/Downloads.aspx?prodId=12&search=package
CVE: CVE-2024-4286
Published: 2024-05-26
Description: Mintplex-Labs' anything-llm application is vulnerable to improper neutralization of special elements used in an expression language statement, identified in the commit id `57984fa85c31988b2eff429adfc654c46e0c342a`. The vulnerability arises from the application's handling of user modifications by managers or admins, allowing for the modification of all existing attributes of the `user` database entity without proper checks or sanitization. This flaw can be exploited to delete user threads, denying users access to their previously submitted data, or to inject fake threads and/or chat history for social engineering attacks.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-917
References: https://github.com/mintplex-labs/anything-llm/commit/1b35bcbeab10b77e6dbd263cceecf1b965a40789; https://huntr.com/bounties/a72d2923-297c-455f-af90-715e83b3da2b; https://github.com/mintplex-labs/anything-llm/commit/1b35bcbeab10b77e6dbd263cceecf1b965a40789
CVE: CVE-2024-5380
Published: 2024-05-26
Description: A vulnerability classified as problematic has been found in jsy-1 short-url 1.0.0. Affected is an unknown function of the file admin.php. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 35c790897d6979392bc6f60707fc32da13a98b63. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-266292.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/jsy-1/short-url/commit/35c790897d6979392bc6f60707fc32da13a98b63; https://gitee.com/jsy-1/short-url/issues/I8UP2A; https://gitee.com/jsy-1/short-url/releases/tag/v2.0.0
CVE: CVE-2024-5381
Published: 2024-05-26
Description: A vulnerability classified as critical was found in itsourcecode Student Information Management System 1.0. Affected by this vulnerability is an unknown functionality of the file view.php. The manipulation of the argument studentId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266293 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Lanxiy7th/lx_CVE_report-/issues/2; https://vuldb.com/?ctiid.266293; https://vuldb.com/?id.266293
CVE: CVE-2024-5383
Published: 2024-05-26
Description: A vulnerability classified as problematic has been found in lakernote EasyAdmin up to 20240324. This affects an unknown part of the file /sys/file/upload. The manipulation of the argument file leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 9c8a836ace17a93c45e5ad52a2340788b7795030. It is recommended to apply a patch to fix this issue. The identifier VDB-266301 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/lakernote/easy-admin/commit/9c8a836ace17a93c45e5ad52a2340788b7795030; https://gitee.com/lakernote/easy-admin/issues/I9B58I; https://vuldb.com/?ctiid.266301
CVE: CVE-2024-30657
Published: 2024-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-30658
Published: 2024-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-5384
Published: 2024-05-27
Description: A vulnerability classified as critical was found in SourceCodester Facebook News Feed Like 1.0. This vulnerability affects unknown code of the file index.php. The manipulation of the argument page leads to sql injection. The attack can be initiated remotely. VDB-266302 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://vuldb.com/?ctiid.266302; https://vuldb.com/?id.266302; https://vuldb.com/?submit.344502
CVE: CVE-2024-5385
Published: 2024-05-27
Description: A vulnerability, which was classified as problematic, has been found in oretnom23 Online Car Wash Booking System 1.0. This issue affects some unknown processing of the file /admin/?page=user/list. The manipulation of the argument First Name/Last Name with the input <script>confirm (document.cookie)</script> leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-266303.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.266303; https://vuldb.com/?id.266303; https://vuldb.com/?submit.344504
CVE: CVE-2024-5390
Published: 2024-05-27
Description: A vulnerability, which was classified as critical, was found in itsourcecode Online Student Enrollment System 1.0. Affected is an unknown function of the file listofstudent.php. The manipulation of the argument lname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266304.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Lanxiy7th/lx_CVE_report-/issues/3; https://vuldb.com/?ctiid.266304; https://vuldb.com/?id.266304
CVE: CVE-2024-5391
Published: 2024-05-27
Description: A vulnerability has been found in itsourcecode Online Student Enrollment System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file listofsubject.php. The manipulation of the argument subjcode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266305 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Lanxiy7th/lx_CVE_report-/issues/4; https://vuldb.com/?ctiid.266305; https://vuldb.com/?id.266305
CVE: CVE-2024-5392
Published: 2024-05-27
Description: A vulnerability was found in itsourcecode Online Student Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file editSubject.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-266306 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Lanxiy7th/lx_CVE_report-/issues/5; https://vuldb.com/?ctiid.266306; https://vuldb.com/?id.266306
CVE: CVE-2024-5393
Published: 2024-05-27
Description: A vulnerability was found in itsourcecode Online Student Enrollment System 1.0. It has been classified as critical. This affects an unknown part of the file listofcourse.php. The manipulation of the argument idno leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266307.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Lanxiy7th/lx_CVE_report-/issues/6; https://vuldb.com/?ctiid.266307; https://vuldb.com/?id.266307
CVE: CVE-2024-5394
Published: 2024-05-27
Description: A vulnerability was found in itsourcecode Online Student Enrollment System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file newDept.php. The manipulation of the argument deptname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266308.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Lanxiy7th/lx_CVE_report-/issues/7; https://vuldb.com/?ctiid.266308; https://vuldb.com/?id.266308
CVE: CVE-2024-5395
Published: 2024-05-27
Description: A vulnerability was found in itsourcecode Online Student Enrollment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file listofinstructor.php. The manipulation of the argument FullName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266309 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/Lanxiy7th/lx_CVE_report-/issues/8; https://vuldb.com/?ctiid.266309; https://vuldb.com/?id.266309
CVE: CVE-2024-5396
Published: 2024-05-27
Description: A vulnerability classified as critical has been found in itsourcecode Online Student Enrollment System 1.0. Affected is an unknown function of the file newfaculty.php. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-266310 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Lanxiy7th/lx_CVE_report-/issues/9; https://vuldb.com/?ctiid.266310; https://vuldb.com/?id.266310
CVE: CVE-2024-5397
Published: 2024-05-27
Description: A vulnerability classified as critical was found in itsourcecode Online Student Enrollment System 1.0. Affected by this vulnerability is an unknown functionality of the file instructorSubjects.php. The manipulation of the argument instructorId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266311.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Lanxiy7th/lx_CVE_report-/issues/10; https://vuldb.com/?ctiid.266311; https://vuldb.com/?id.266311
CVE: CVE-2024-36384
Published: 2024-05-27
Description: Pointsharp Cryptshare Server before 7.0.0 has an XSS issue that is related to notification messages.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cryptshare.com/w/CSSCurrent_en:Version_7.0.0#Additional_Changes; https://documentation.cryptshare.com/w/CSSCurrent_en:Version_7.0.0#Additional_Changes
CVE: CVE-2024-5399
Published: 2024-05-27
Description: Openfind Mail2000 does not properly filter parameters of specific API. Remote attackers with administrative privileges can exploit this vulnerability to execute arbitrary system commands on the remote server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7817-6ce29-1.html; https://www.twcert.org.tw/tw/cp-132-7817-6ce29-1.html
CVE: CVE-2024-35291
Published: 2024-05-27
Description: Cross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN56781258/; https://splunkbase.splunk.com/app/4353; https://jvn.jp/en/jp/JVN56781258/
CVE: CVE-2024-35297
Published: 2024-05-27
Description: Cross-site scripting vulnerability exists in WP Booking versions prior to 2.4.5. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing the web site using the product.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN35838128/; https://plugins.trac.wordpress.org/changeset?new=3084990%40wp-easy-booking%2Ftrunk%2Fview%2Ffrontend%2Fbooking-locations.php&old=2404687%40wp-easy-booking%2Ftrunk%2Fview%2Ffrontend%2Fbooking-locations.php; https://wordpress.org/plugins/wp-easy-booking/
CVE: CVE-2024-3933
Published: 2024-05-27
Description: In Eclipse OpenJ9 release versions prior to 0.44.0 and after 0.13.0, when running with JVM option -Xgc:concurrentScavenge, the sequence generated for System.arrayCopy on the IBM Z platform with hardware and software support for guarded storage [1], could allow access to a buffer with an incorrect length value when executing an arraycopy sequence while the Concurrent Scavenge Garbage Collection cycle is active and the source and destination memory regions for arraycopy overlap. This allows read and write to addresses beyond the end of the array range.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125, CWE-787, CWE-805, CWE-125, CWE-787
References: https://github.com/eclipse/omr/pull/7275; https://gitlab.eclipse.org/security/cve-assignement/-/issues/21; https://github.com/eclipse/omr/pull/7275
CVE: CVE-2024-3939
Published: 2024-05-27
Description: The Ditty  WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/; https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/
CVE: CVE-2024-4529
Published: 2024-05-27
Description: The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as deleting card categories via CSRF attacks
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/082ff0b8-2ecd-4292-832d-0a79e1ba8cb3/; https://wpscan.com/vulnerability/082ff0b8-2ecd-4292-832d-0a79e1ba8cb3/
CVE: CVE-2024-4530
Published: 2024-05-27
Description: The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as editing card categories via CSRF attacks
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/952f6b5c-7728-4c87-8826-6b493f51a979/; https://wpscan.com/vulnerability/952f6b5c-7728-4c87-8826-6b493f51a979/
CVE: CVE-2024-4531
Published: 2024-05-27
Description: The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as editing cards via CSRF attacks
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/18c1b3bb-9998-416f-a972-c4a51643579c/; https://wpscan.com/vulnerability/18c1b3bb-9998-416f-a972-c4a51643579c/
CVE: CVE-2024-4532
Published: 2024-05-27
Description: The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as deleting cards via CSRF attacks
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/64cf5f95-bbf0-4c5f-867b-62f1b7f6a42e/; https://wpscan.com/vulnerability/64cf5f95-bbf0-4c5f-867b-62f1b7f6a42e/
CVE: CVE-2024-4533
Published: 2024-05-27
Description: The KKProgressbar2 Free  WordPress plugin through 1.1.4.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin users to perform SQL injection attacks
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://wpscan.com/vulnerability/c3406236-aaee-480a-8931-79c867252f11/; https://wpscan.com/vulnerability/c3406236-aaee-480a-8931-79c867252f11/
CVE: CVE-2024-4534
Published: 2024-05-27
Description: The KKProgressbar2 Free  WordPress plugin through 1.1.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/7b0046d4-cf95-4307-95a5-9b823f2daaaa/; https://wpscan.com/vulnerability/7b0046d4-cf95-4307-95a5-9b823f2daaaa/
CVE: CVE-2024-4535
Published: 2024-05-27
Description: The KKProgressbar2 Free  WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/d4980886-da10-4bbc-a84a-fe071ab3b755/; https://wpscan.com/vulnerability/d4980886-da10-4bbc-a84a-fe071ab3b755/
CVE: CVE-2024-5400
Published: 2024-05-27
Description: Openfind Mail2000 does not properly filter parameters of specific CGI. Remote attackers with regular privileges can exploit this vulnerability to execute arbitrary system commands on the remote server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7819-9661a-1.html; https://www.twcert.org.tw/tw/cp-132-7819-9661a-1.html
CVE: CVE-2024-26289
Published: 2024-05-27
Description: Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://forge.sigb.net/projects/pmb/files; https://github.com/enisaeu/CNW/blob/main/advisories/2024/CNW-2024-A-12.md; https://forge.sigb.net/projects/pmb/files
CVE: CVE-2024-27314
Published: 2024-05-27
Description: Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-79
References: https://www.manageengine.com/products/service-desk/cve-2024-27314.html; https://www.manageengine.com/products/service-desk/cve-2024-27314.html
CVE: CVE-2024-5403
Published: 2024-05-27
Description: ASKEY 5G NR Small Cell fails to properly filter user input for certain functionality, allowing remote attackers with administrator privilege to execute arbitrary system commands on the remote server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7821-87e38-1.html; https://www.twcert.org.tw/tw/cp-132-7821-87e38-1.html
CVE: CVE-2024-5035
Published: 2024-05-27
Description: The affected device expose a network service called "rftest" that is vulnerable to unauthenticated command injection on ports TCP/8888, TCP/8889, and TCP/8890. By successfully exploiting this flaw, remote unauthenticated attacker can gain arbitrary command execution on the device with elevated privileges.This issue affects Archer C4500X: through 1_1.1.6.
CWE: CWE-77
References: https://onekey.com/blog/security-advisory-remote-command-execution-on-tp-link-archer-c5400x/; https://www.tp-link.com/en/support/download/archer-c5400x/#Firmware; https://onekey.com/blog/security-advisory-remote-command-execution-on-tp-link-archer-c5400x/