rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-26951 
Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and gets executed by the web browser in the context of the vulnerable web application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:N/I:H/PR:N/S:U/UI:R
version: 3.1
Published: 2022-03-29T23:33:27.000Z
CVE-2022-26952 
Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow in the function for building the Location header string when an unauthenticated user is redirected to the authentication page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-06T00:43:38.000Z
CVE-2022-26953 
Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow. An attacker can supply a string in the page parameter for reboot.asp endpoint, allowing him to force an overflow when the string is concatenated to the HTML body.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-06T00:43:31.000Z
CVE-2022-26954 
Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter, processed by the (1) ChangePassword function, (2) SignInCustomerAsync function, (3) SuccessfulAuthentication method, or (4) NopRedirectResultExecutor class.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-20T00:00:00.000Z
CVE-2022-26959 
There are two full (read/write) Blind/Time-based SQL injection vulnerabilities in the Northstar Club Management version 6.3 application. The vulnerabilities exist in the userName parameter of the processlogin.jsp page in the /northstar/Portal/ directory and the userID parameter of the login.jsp page in the /northstar/iphone/ directory. Exploitation of the SQL injection vulnerabilities allows full access to the database which contains critical data for organization’s that make full use of the software suite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
version: 3.1
Published: 2022-09-16T01:51:08.000Z
CVE-2022-26960 
connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-21T16:52:38.000Z
CVE-2022-26964 
Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-force attack. An error caused base64 to be decoded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:H/AV:N/A:N/C:H/I:H/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
Published: 2022-12-26T00:00:00.000Z
CVE-2022-26965 
In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T06:33:34.000Z
CVE-2022-26966 
An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-12T21:30:43.000Z
CVE-2022-26967 
GPAC 2.0 allows a heap-based buffer overflow in gf_base64_encode. It can be triggered via MP4Box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-12T00:00:00.000Z
CVE-2022-26969 
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-26971 
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. This upload can be executed without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T11:34:37.000Z
CVE-2022-26972 
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /cgi-bin endpoint. The URL parameters are not correctly sanitized, leading to reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T11:34:42.000Z
CVE-2022-26973 
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. By tweaking the license file name, the returned error message exposes internal directory path details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T11:34:48.000Z
CVE-2022-26974 
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a file upload mechanism. Lack of input sanitization in the upload mechanism leads to reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T11:34:54.000Z
CVE-2022-26975 
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing log files without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T11:34:59.000Z
CVE-2022-26976 
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of input sanitization in the upload mechanism is leads to reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T11:35:06.000Z
CVE-2022-26977 
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of input sanitization of the upload mechanism is leads to stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T11:35:16.000Z
CVE-2022-26978 
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /checklogin.jsp endpoint. The os_username parameters is not correctly sanitized, leading to reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T11:35:22.000Z
CVE-2022-26979 
Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 allow a NULL pointer dereference when this.Span is used for oState of Collab.addStateModel, because this.Span.text can be NULL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-06T20:45:01.000Z
CVE-2022-26980 
Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T18:00:20.000Z
CVE-2022-26981 
Liblouis through 3.21.0 has a buffer overflow in compilePassOpcode in compileTranslationTable.c (called, indirectly, by tools/lou_checktable.c).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-13T00:00:00.000Z
CVE-2022-26982 
SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. NOTE: the vendor's position is that administrators are intended to have the ability to modify themes, and can thus choose any PHP code that they wish to have executed on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T00:00:00.000Z
CVE-2022-26986 
SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T00:00:00.000Z
CVE-2022-26987 
TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow issue in `MmtAtePrase` function. Local users could get remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-10T14:22:14.000Z
CVE-2022-26988 
TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow issue in `MntAte` function. Local users could get remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-10T14:26:42.000Z
CVE-2022-26990 
Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the firewall-local log function via the EmailAddress, SmtpServerName, SmtpUsername, and SmtpPassword parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:25.000Z
CVE-2022-26991 
Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ntp function via the TimeZone parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:25.000Z
CVE-2022-26992 
Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ddns function via the DdnsUserName, DdnsHostName, and DdnsPassword parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:26.000Z
CVE-2022-26993 
Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pppoe function via the pppoeUserName, pppoePassword, and pppoe_Service parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:27.000Z
CVE-2022-26994 
Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pptp function via the pptpUserName and pptpPassword parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:27.000Z
CVE-2022-26995 
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp (wan_pptp.html) function via the pptp_fix_ip, pptp_fix_mask, pptp_fix_gw, and wan_dns1_stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:28.000Z
CVE-2022-26996 
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoe_username, pppoe_passwd, and pppoe_servicename parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:29.000Z
CVE-2022-26997 
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnp_ttl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:29.000Z
CVE-2022-26998 
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:30.000Z
CVE-2022-26999 
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wan_ip_stat, wan_mask_stat, wan_gw_stat, and wan_dns1_stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:31.000Z
CVE-2022-27000 
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_server, h_backup_ntp_server, and h_time_zone parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:31.000Z
CVE-2022-27001 
Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:32.000Z
CVE-2022-27002 
Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:33.000Z
CVE-2022-27003 
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6rd function via the relay6rd parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:33.000Z
CVE-2022-27004 
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4 parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:36.000Z
CVE-2022-27005 
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T21:56:35.000Z
CVE-2022-27007 
nginx njs 0.7.2 is affected suffers from Use-after-free in njs_function_frame_alloc() when it try to invoke from a restored frame saved with njs_function_frame_save().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-14T14:08:19.000Z
CVE-2022-27008 
nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-14T14:04:56.000Z
CVE-2022-27016 
There is a stack overflow vulnerability in the SetStaticRouteCfg() function in the httpd service of Tenda AC9 15.03.2.21_cn.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-07T14:20:03.000Z
CVE-2022-27022 
There is a stack overflow vulnerability in the SetSysTimeCfg() function in the httpd service of Tenda AC9 V15.03.2.21_cn. The attacker can obtain a stable root shell through a constructed payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-07T15:02:46.000Z
CVE-2022-27041 
Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract information from databases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-11T13:36:03.000Z
CVE-2022-27043 
Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Neptune is vulnerable to Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T14:08:36.000Z
CVE-2022-27044 
libsixel 1.8.6 is affected by Buffer Overflow in libsixel/src/quant.c:876.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T14:58:03.000Z
CVE-2022-27046 
libsixel 1.8.6 suffers from a Heap Use After Free vulnerability in in libsixel/src/dither.c:388.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T14:51:00.000Z
CVE-2022-27047 
mogu_blog_cms 5.2 suffers from upload arbitrary files without any limitation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T15:42:13.000Z
CVE-2022-27048 
A vulnerability has been discovered in Moxa MGate which allows an attacker to perform a man-in-the-middle (MITM) attack on the device. This affects MGate MB3170 Series Firmware Version 4.2 or lower. and MGate MB3270 Series Firmware Version 4.2 or lower. and MGate MB3280 Series Firmware Version 4.1 or lower. and MGate MB3480 Series Firmware Version 3.2 or lower.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T18:10:41.000Z
CVE-2022-27049 
Raidrive before v2021.12.35 allows attackers to arbitrarily move log files by pre-creating a mountpoint and log files before Raidrive is installed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T22:11:33.000Z
CVE-2022-27050 
BitComet Service for Windows before version 1.8.6 contains an unquoted service path vulnerability which allows attackers to escalate privileges to the system level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T22:11:33.000Z
CVE-2022-27052 
FreeFtpd version 1.0.13 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T22:11:34.000Z
CVE-2022-27055 
ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content/apps/installer/classes/Helper.php. When the web program is installed, a new environment file is created, and the database information is recorded, including the database record password. NOTE: the vendor disputes this because the environment file is in the data directory, which is not intended for access by website visitors (only the statics directory can be accessed by website visitors)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-19T16:47:28.000Z
CVE-2022-27061 
AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T08:23:33.000Z
CVE-2022-27062 
AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T08:23:34.000Z
CVE-2022-27063 
AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via view_all_comments.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T08:23:35.000Z
CVE-2022-27064 
Musical World v1 was discovered to contain an arbitrary file upload vulnerability via uploaded_songs.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T08:23:35.000Z
CVE-2022-27076 
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/delAd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T23:25:00.000Z
CVE-2022-27077 
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadWeiXinPic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T23:25:00.000Z
CVE-2022-27078 
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setAdInfoDetail.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T23:25:01.000Z
CVE-2022-27079 
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setPicListItem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T23:25:02.000Z
CVE-2022-27080 
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setWorkmode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T23:25:03.000Z
CVE-2022-27081 
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T23:25:04.000Z
CVE-2022-27082 
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T23:25:04.000Z
CVE-2022-27083 
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T23:25:05.000Z