rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-10043 Astium VOIP PBX <= 2.1 SQL Injection File Upload RCE
A vulnerability exists in OAstium VoIP PBX astium-confweb-2.1-25399 and earlier, where improper input validation in the logon.php script allows an attacker to bypass authentication via SQL injection. Once authenticated as an administrator, the attacker can upload arbitrary PHP code through the importcompany field in import.php, resulting in remote code execution. The malicious payload is injected into /usr/local/astium/web/php/config.php and executed with root privileges by triggering a configuration reload via sudo /sbin/service astcfgd reload. Successful exploitation leads to full system compromise.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Astium
product: VoIP PBX
default_status: unaffected
Credits: lang: en
value: xistence
Published: 2025-07-31T14:53:20.420Z
CVE-2013-10044 OpenEMR ≤ 4.1.1 SQL Injection Privilege Escalation and RCE
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file upload flaw to achieve remote code execution, resulting in full compromise of the application and its host system.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: OpenEMR Foundation
product: OpenEMR
default_status: unaffected
Credits: lang: en
value: xistence
Published: 2025-08-01T20:46:45.592Z
CVE-2013-10046 Agnitum Outpost Internet Security Local Privilege Escalation
A local privilege escalation vulnerability exists in Agnitum Outpost Internet Security 8.1 that allows an unprivileged user to execute arbitrary code with SYSTEM privileges. The flaw resides in the acs.exe component, which exposes a named pipe that accepts unauthenticated commands. By exploiting a directory traversal weakness in the pipe protocol, an attacker can instruct the service to load a malicious DLL from a user-controlled location. The DLL is then executed in the context of the privileged service.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Agnitum Ltd.
product: Outpost Internet Security
default_status: unknown
Credits: lang: en
value: Ahmad Moghimi
Published: 2025-08-01T20:37:55.129Z
CVE-2013-10047 MiniWeb <= Build 300 Arbitrary File Upload
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote attackers to upload arbitrary files to the server’s filesystem. By abusing the upload handler and crafting a traversal path, an attacker can place a malicious .exe in system32, followed by a .mof file in the WMI directory. This triggers execution of the payload with SYSTEM privileges via the Windows Management Instrumentation service. The exploit is only viable on Windows versions prior to Vista.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: MiniWeb
product: MiniWeb
default_status: unknown
Credits: lang: en
value: AkaStep
Published: 2025-08-01T20:45:12.385Z
CVE-2013-10048 D-Link Devices command.php Unauthenticated RCE
An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker can execute arbitrary shell commands with root privileges, allowing full takeover of the device. This includes launching services such as Telnet, exfiltrating credentials, modifying system configuration, and disrupting availability. The flaw stems from the lack of authentication and inadequate sanitation of the cmd parameter.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: D-Link
product: DIR-600
default_status: unknown
vendor: D-Link
product: DIR-300
default_status: unknown
Credits: lang: en
value: Michael Messner
Published: 2025-08-01T20:39:20.417Z
CVE-2013-10049 Raidsonic NAS Devices Unauthenticated Remote Command Execution
An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to properly sanitize user-supplied input in the timeZone parameter of a POST request, allowing remote attackers to inject arbitrary shell commands.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Raidsonic Technology GmbH
product: IB-NAS5220
default_status: unaffected
vendor: Raidsonic Technology GmbH
product: IB-NAS4220
default_status: unaffected
Credits: lang: en
value: Michael Messner
Published: 2025-08-01T20:47:35.716Z
CVE-2013-10050 D-Link Devices tools_vct.xgi Authenticated RCE
An OS command injection vulnerability exists in multiple D-Link routers (confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13) via the authenticated tools_vct.xgi CGI endpoint. The web interface fails to properly sanitize user-supplied input in the pingIp parameter, allowing attackers with valid credentials to inject arbitrary shell commands. Exploitation enables full device compromise, including spawning a telnet daemon and establishing a root shell. The vulnerability is present in firmware versions that expose tools_vct.xgi and use the Mathopd/1.5p6 web server. No vendor patch is available, and affected models are end-of-life.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: D-Link
product: DIR-300 rev A
default_status: unaffected
vendor: D-Link
product: DIR-615 rev D
default_status: unaffected
Credits: lang: en
value: Michael Messner
Published: 2025-08-01T20:39:00.384Z
CVE-2013-10051 InstantCMS <= 1.6 Remote PHP Code Execution
A remote PHP code execution vulnerability exists in InstantCMS version 1.6 and earlier due to unsafe use of eval() within the search view handler. Specifically, user-supplied input passed via the look parameter is concatenated into a PHP expression and executed without proper sanitation. A remote attacker can exploit this flaw by sending a crafted HTTP GET request with a base64-encoded payload in the Cmd header, resulting in arbitrary PHP code execution within the context of the web server.
Problem types: cwe_id: CWE-95
description: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Affected products: vendor: InstantCMS
product: InstantCMS
default_status: unknown
Credits: lang: en
value: Ricardo Jorge Borges de Almeida
Published: 2025-08-01T20:41:38.540Z
CVE-2013-10052 ZPanel zsudo Local Privilege Escalation
ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw enables local attackers with shell access to escalate privileges by writing a payload to a writable directory and executing it via zsudo. The vulnerability is particularly impactful in post-exploitation scenarios following web server compromise, where the attacker inherits access to zsudo.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: ZPanel Project
product: ZPanel
default_status: unaffected
Credits: lang: en
value: sinn3r
lang: en
value: juan vazquez
Published: 2025-08-04T18:03:58.414Z
CVE-2013-10053 ZPanel <= 10.0.0.2 htpasswd Module Username Command Execution
A remote command execution vulnerability exists in ZPanel version 10.0.0.2 in its htpasswd module. When creating .htaccess files, the inHTUsername field is passed unsanitized to a system() call that invokes the system’s htpasswd binary. By injecting shell metacharacters into the username field, an authenticated attacker can execute arbitrary system commands. Exploitation requires a valid ZPanel account—such as one in the default Users, Resellers, or Administrators groups—but no elevated privileges.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: ZPanel Project
product: ZPanel
default_status: unaffected
Credits: lang: en
value: shachibista
Published: 2025-08-01T20:49:05.360Z
CVE-2013-10054 LibrettoCMS File Manager Arbitrary File Upload
An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 (and possibly earlier) contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php fails to properly validate file extensions, allowing attackers to upload files with misleading extensions and subsequently rename them to executable .php scripts. This enables remote code execution on the server without authentication.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: LibrettoCMS
product: LibrettoCMS
default_status: unknown
Credits: lang: en
value: CWH
lang: en
value: sinn3r
Published: 2025-08-04T18:04:25.900Z
CVE-2013-10055 Havalite CMS Arbitary File Upload RCE
An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 (and possibly earlier) in the upload.php script. The application fails to enforce proper file extension validation and authentication checks, allowing remote attackers to upload malicious PHP files via a crafted multipart/form-data POST request. Once uploaded, the attacker can access the file directly under havalite/tmp/files/, resulting in remote code execution.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Havalite CMS
product: Havalite CMS
default_status: unknown
Credits: lang: en
value: CWH
lang: en
value: sinn3r
Published: 2025-08-01T20:39:41.767Z
CVE-2013-10057 Synactis PDF In-The-Box ConnectToSynactic Stack-Based Buffer Overflow
A stack-based buffer overflow vulnerability exists in Synactis PDF In-The-Box ActiveX control (PDF_IN_1.ocx), specifically the ConnectToSynactis method. When a long string is passed to this method—intended to populate the ldCmdLine argument of a WinExec call—a strcpy operation overwrites a saved TRegistry class pointer on the stack. This allows remote attackers to execute arbitrary code in the context of the user by enticing them to visit a malicious webpage that instantiates the vulnerable ActiveX control. The vulnerability was discovered via its use in third-party software such as Logic Print 2013.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Synactis
product: PDF In-The-Box
default_status: unaffected
Credits: lang: en
value: h1ch4m
Published: 2025-08-01T20:48:30.424Z
CVE-2013-10058 Linksys Routers apply.cgi Remote Command Injection
An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied input passed to the ping_size parameter during diagnostic operations. An attacker with valid credentials can inject arbitrary shell commands, enabling remote code execution.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Linksys
product: WRT160nv2
default_status: unknown
Credits: lang: en
value: Michael Messner
Published: 2025-08-01T20:44:51.202Z
CVE-2013-10059 D-Link Routers tools_vct.htm OS Command Injection
An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr parameter to the tools_vct.htm diagnostic interface, allowing attackers to inject arbitrary shell commands using backtick encapsulation. With default credentials, an attacker can exploit this blind injection vector to execute arbitrary commands.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: D-Link
product: DIR-615H1
default_status: unaffected
Credits: lang: en
value: Michael Messner
Published: 2025-08-01T20:38:13.525Z
CVE-2013-10060 Netgear Routers pppoe.cgi RCE
An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN2200B model) firmware versions 1.0.0.36 and prior via the pppoe.cgi endpoint. A remote attacker with valid credentials can execute arbitrary commands via crafted input to the pppoe_username parameter. This flaw allows full compromise of the device and may persist across reboots unless configuration is restored.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Netgear
product: DGN2200B
default_status: unaffected
Credits: lang: en
value: Michael Messner
Published: 2025-08-01T20:45:59.280Z
CVE-2013-10061 Netgear Routers setup.cgi RCE
An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the TimeToLive parameter in the setup.cgi endpoint. The vulnerability arises from improper input neutralization, enabling command injection through crafted POST requests. This flaw enables remote attackers to deploy payloads or manipulate system state post-authentication.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Netgear
product: DGN1000B
default_status: unaffected
Credits: lang: en
value: Michael Messner
Published: 2025-08-01T20:45:34.559Z
CVE-2013-10062 Linksys Routers apply.cgi Path Traversal
A directory traversal vulnerability exists in Linksys router's web interface (tested on the E1500 model firmware versions 1.0.00, 1.0.04, and 1.0.05), specifically in the /apply.cgi endpoint. Authenticated attackers can exploit the next_page POST parameter to access arbitrary files outside the intended web root by injecting traversal sequences. This allows exposure of sensitive system files and configuration data.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Linksys
product: E1500
default_status: unaffected
Credits: lang: en
value: Michael Messner
Published: 2025-08-01T20:44:28.559Z
CVE-2013-10063 Netgear SPH200D <= 1.0.4.80 Path Traversal via HTTP GET
A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences. This can expose sensitive system files and configuration data.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Netgear
product: SPH200D
default_status: unaffected
Credits: lang: en
value: Michael Messner
Published: 2025-08-01T20:46:21.225Z
CVE-2013-10064 ActFax 5.01 RAW Server Buffer Overflow
A stack-based buffer overflow vulnerability exists in ActFax Server version 5.01. The server's RAW protocol interface fails to safely process user-supplied data in @F506 fax header fields due to insecure usage of strcpy. Remote attackers can exploit this vulnerability by sending specially crafted @F506 fields, potentially leading to arbitrary code execution. Successful exploitation requires network access to TCP port 4559 and does not require authentication.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: ActFax Communication
product: ActFax Server
default_status: unknown
Credits: lang: en
value: Craig Freyman
Published: 2025-08-05T19:58:41.458Z
CVE-2013-10065 Sysax Multi-Server <= 6.10 SSHD Key Exchange DoS
A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH key exchange packet can trigger a crash in the service, resulting in loss of availability. The flaw is triggered during the handling of malformed key exchange data, including a non-standard byte (\x28) in place of the expected SSH protocol delimiter.
Problem types: cwe_id: CWE-248
description: CWE-248 Uncaught Exception
Affected products: vendor: Sysax Software
product: Multi-Server
default_status: unknown
Credits: lang: en
value: Matt "hostess" Andreko
Published: 2025-08-05T20:05:06.769Z
CVE-2013-10066 Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload
An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows attackers to upload files to the /userpictures/ directory without authentication. This flaw enables remote code execution by uploading a PHP payload and invoking it via a direct HTTP request.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Kordil
product: EDMS
default_status: unknown
Credits: lang: en
value: bcoles
Published: 2025-08-05T20:02:54.434Z
CVE-2013-10067 Glossword 1.8.8 - 1.8.12 Arbitrary File Upload RCE
Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface (gw_admin.php) allows users with administrator privileges to upload files to the gw_temp/a/ directory. Due to insufficient validation of file type and path, attackers can upload and execute PHP payloads, resulting in remote code execution.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Glossword Team
product: Glossword
default_status: unknown
Credits: lang: en
value: AkaStep
Published: 2025-08-05T20:02:33.203Z
CVE-2013-10068 Foxit Reader <= 5.4.5.0114 Plugin URL Processing Buffer Overflow
Foxit Reader versions through 5.4.5.0114, including the bundled Foxit Reader Plugin 2.2.1.530, contains a stack-based buffer overflow vulnerability in the npFoxitReaderPlugin.dll module. When a PDF file is loaded from a remote host, an overly long query string in the URL can overflow a buffer, allowing remote attackers to execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Foxit
product: Foxit Reader
default_status: unaffected
Credits: lang: en
value: rgod
Published: 2025-08-05T20:01:26.073Z
CVE-2013-10069 D-Link Devices Unauthenticated RCE
The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to spawn a Telnet service on a specified port, enabling persistent interactive shell access as root.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: D-Link
product: DIR-600 rev B
default_status: unaffected
vendor: D-Link
product: DIR-300 rev B
default_status: unaffected
Credits: lang: en
value: Michael Messner
Published: 2025-08-05T20:01:04.000Z
CVE-2013-10070 PHP-Charts v1.0 PHP Code Execution
PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names are passed directly to eval() without sanitization. A remote attacker can exploit this flaw by crafting a request that injects arbitrary PHP code, resulting in command execution under the web server's context. The vulnerability allows unauthenticated attackers to execute system-level commands via base64-encoded payloads embedded in parameter names, leading to full compromise of the host system.
Problem types: cwe_id: CWE-95
description: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Affected products: vendor: PHP-Charts
product: PHP-Charts
default_status: unknown
Credits: lang: en
value: AkaStep
Published: 2025-08-05T20:04:44.526Z
CVE-2013-10071 Nagios XI < 2012R1.6 Reflected XSS via Dashlet AJAX Load Functionality
Nagios XI versions prior to 2012R1.6 contain a reflected cross-site scripting (XSS) vulnerability in the dashboard dashlet AJAX load functionality. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Credits: lang: en
value: James Clawson
Published: 2025-10-30T21:43:34.559Z
CVE-2013-10072 Nagios XI < 2012R1.6 Auto-Discovery Missing Authorization
Nagios XI versions prior to 2012R1.6 contain an authorization flaw in the Auto-Discovery functionality. Users with read-only roles could directly reach Auto-Discovery endpoints and pages that should require elevated permissions, exposing discovery results and allowing unintended access to discovery operations.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Credits: lang: en
value: James Clawson
Published: 2025-10-30T21:32:02.900Z
CVE-2013-10073 Nagios XI < 2012R1.6 Auto-Discovery Shell Command Injection
Nagios XI versions prior to 2012R1.6 contain a shell command injection vulnerability in the Auto-Discovery tool. User-controlled input is passed to a shell without adequate sanitation or argument quoting, allowing an authenticated user with access to discovery functionality to execute arbitrary commands with the privileges of the application service.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Credits: lang: en
value: James Clawson
Published: 2025-10-30T21:32:22.811Z
CVE-2013-10074 Nagios XI < 2012R2.6 XSS via Tools Menu
Nagios XI versions prior to 2012R2.6 are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Published: 2025-10-30T21:56:22.290Z