St4R

**Name of the Vulnerable Software and Affected Versions** activepieces versions prior to 0.83.0 **Description** A remote server-side request forgery (SSRF) exists in the File URL Handler component. The issue is located within the `handleUrlFile()` function in the `packages/server/engine/src/lib/variables/processors/file.ts` library. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `handleUrlFile()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** langflow-ai langflow versions prior to 1.9.4 **Description** An issue exists in the Bundle URL Loader component where manipulation of an unknown function allows for code injection. This attack must be performed locally. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FlowiseAI Flowise versions prior to 3.1.3 **Description** A path traversal issue exists in the S3 Document Loader component, specifically within an unknown function of the file `packages/components/nodes/documentloaders/S3/S3.ts`. This flaw allows a remote attacker to perform a manipulation that leads to unauthorized access to files or directories outside the intended folder. **Recommendations** Update to a version later than 3.1.2. As a temporary workaround, restrict the use of the S3 Document Loader component until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** coollabsio coolify versions 4.0.0 through 4.1.1 **Description** An OS command injection flaw exists in the Image Name Handler component. This issue allows a remote attacker to execute arbitrary operating system commands through the manipulation of an unknown function within that component. **Recommendations** Update to version 4.1.2.

**Name of the Vulnerable Software and Affected Versions** Tenda AC6 version 15.03.06.23 **Description** A remote OS command injection exists in the `httpd` component. The issue occurs within the `get log file()` function of the '/goform/getLogFile' endpoint, where improper manipulation of the `wans.flag` argument allows for the execution of arbitrary operating system commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/goform/getLogFile' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tenda AC6 version 15.03.06.23 **Description** A weakness in the `httpd` component allows remote OS command injection. The issue exists within the `formWifiApScan()` function located in the `/goform/WifiApScan` endpoint. An attacker can trigger this by manipulating the `wl2g.public.country` or `wl5g.public.country` arguments. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/goform/WifiApScan` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tenda AC6 2.0 version 15.03.06.23 **Description** An OS command injection issue exists in the httpd component within the '/goform/telnet' file. This occurs when the `lan.ip` argument is manipulated, allowing for remote exploitation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC6 version 15.03.06.49 multi TDE01 **Description** A flaw in the `httpd` component allows remote attackers to perform OS command injection. The issue exists within the `fromSetWirelessRepeat()` function located in the '/goform/WifiExtraSet' endpoint, where manipulating the `mac` or `ssid` arguments enables the execution of arbitrary operating system commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/goform/WifiExtraSet' endpoint or avoid using the `mac` and `ssid` parameters within that endpoint.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-320 version 2.06B01 **Description** A flaw in the '/cgi-bin/webfile mgr.cgi' endpoint allows remote attackers to perform OS command injection. This occurs through the manipulation of the `delete`, `rename`, `copy`, `move`, `chmod`, and `chown` functions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-320 version 2.06B01 **Description** Remote OS command injection is possible via the '/cgi-bin/network mgr.cgi' endpoint. The issue exists within the functions `cgi speed()`, `cgi dhcpd lease()`, `cgi ddns()`, `cgi set ip()`, `cgi upnp del()`, `cgi dhcpd()`, `cgi upnp add()`, and `cgi upnp edit()`. This allows a remote attacker to execute arbitrary operating system commands on the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** D-Link DNS-320 version 2.06B01 **Description** A weakness in the '/cgi-bin/system mgr.cgi' file allows for remote OS command injection. This issue affects the `cgi set host()`, `cgi set ntp()`, `cgi fan control()`, and `cgi merge user()` functions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Wavlink WL-WN530H4 versions prior to 2026.04.16 **Description** OS command injection is possible in the '/cgi-bin/internet.cgi' file through the manipulation of the `strcat()` and `snprintf()` functions. This issue allows a remote attacker to execute arbitrary operating system commands. **Recommendations** Update to version 2026.04.16.