CRITICAL🇵🇱 Wersja polska

CVE-2021-26753

CVSS 9.9v3.1pub. 2021-02-12upd. 2024-11-21

NeDi 1.9C allows an authenticated user to inject PHP code in the System Files function on the endpoint /System-Files.php via the txt HTTP POST parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Nedi

    APP
    Nedi
    1.9c
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-40895CRITICAL9.1PL ✓same product

NeDi — User Enumeration w formularzu logowania i resetowania hasła

CVE-2021-26752HIGH8.8same product

NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on t...

CVE-2021-26751HIGH8.8same product

NeDi 1.9C allows an authenticated user to perform a SQL Injection in the Monitoring History function on the en...

CVE-2020-14414HIGH8.8same product

NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a ...

CVE-2020-14412HIGH8.8same product

NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacte...