ΠΠΎΠ»ΠΈΡΠ΅ΡΡΠ²ΠΎ 3
ΠΠΎΠ»ΠΈΡΠ΅ΡΡΠ²ΠΎ 3
CVE-2021-47667
An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters in the tmp_name parameter when dropping off a file via a POST /dropoff request.
GHSA-r4mc-p68x-wx22
An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters in the tmp_name parameter when dropping off a file via a POST /dropoff request.
BDU:2026-00884
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΡΡΠ΅Π½Π°ΡΠΈΡ lib/NSSDropoff.php Π²Π΅Π±-ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΡ Π΄Π»Ρ ΠΏΠ΅ΡΠ΅Π΄Π°ΡΠΈ ΡΠ°ΠΉΠ»ΠΎΠ² ZendTo, ΠΏΠΎΠ·Π²ΠΎΠ»ΡΡΡΠ°Ρ Π½Π°ΡΡΡΠΈΡΠ΅Π»Ρ Π²ΡΠΏΠΎΠ»Π½ΠΈΡΡ ΠΏΡΠΎΠΈΠ·Π²ΠΎΠ»ΡΠ½ΡΠ΅ ΠΊΠΎΠΌΠ°Π½Π΄Ρ
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΠ΅ΠΉ Π½Π° ΡΡΡΠ°Π½ΠΈΡΡ
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ | CVSS | EPSS | ΠΠΏΡΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½ΠΎ | |
|---|---|---|---|---|
 | CVE-2021-47667 An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters in the tmp_name parameter when dropping off a file via a POST /dropoff request. | CVSS3: 10 | 33% Π‘ΡΠ΅Π΄Π½ΠΈΠΉ | Π±ΠΎΠ»ΡΡΠ΅ 1 Π³ΠΎΠ΄Π° Π½Π°Π·Π°Π΄ |
| GHSA-r4mc-p68x-wx22 An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters in the tmp_name parameter when dropping off a file via a POST /dropoff request. | CVSS3: 10 | 33% Π‘ΡΠ΅Π΄Π½ΠΈΠΉ | Π±ΠΎΠ»ΡΡΠ΅ 1 Π³ΠΎΠ΄Π° Π½Π°Π·Π°Π΄ |
 | BDU:2026-00884 Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΡΡΠ΅Π½Π°ΡΠΈΡ lib/NSSDropoff.php Π²Π΅Π±-ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΡ Π΄Π»Ρ ΠΏΠ΅ΡΠ΅Π΄Π°ΡΠΈ ΡΠ°ΠΉΠ»ΠΎΠ² ZendTo, ΠΏΠΎΠ·Π²ΠΎΠ»ΡΡΡΠ°Ρ Π½Π°ΡΡΡΠΈΡΠ΅Π»Ρ Π²ΡΠΏΠΎΠ»Π½ΠΈΡΡ ΠΏΡΠΎΠΈΠ·Π²ΠΎΠ»ΡΠ½ΡΠ΅ ΠΊΠΎΠΌΠ°Π½Π΄Ρ | CVSS3: 10 | 33% Π‘ΡΠ΅Π΄Π½ΠΈΠΉ | Π±ΠΎΠ»ΡΡΠ΅ 1 Π³ΠΎΠ΄Π° Π½Π°Π·Π°Π΄ |
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΠ΅ΠΉ Π½Π° ΡΡΡΠ°Π½ΠΈΡΡ