Ph0Jav7

2 exploits Active since May 2024

CVE-2024-34852 WRITEUP MEDIUM WRITEUP

F-logic DataCube3 v1.0 - Unauthenticated Command Injection via transceiver_schedule.php File Name

F-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/transceiver_schedule.php file. An unauthenticated remote attacker can exploit this vulnerability by sending a file name containing command injection. Successful exploitation of this vulnerability may allow the attacker to execute system commands.

CVSS 6.3

View Code

CVE-2024-34854 WRITEUP CRITICAL WRITEUP

F-logic DataCube3 v1.0 - Path Traversal via File Upload in transceiver_schedule.php

F-logic DataCube3 v1.0 is vulnerable to File Upload via `/admin/transceiver_schedule.php.`

CVSS 9.8

View Code