7.2
CVSS
A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.
Severity: HIGH
📦
router_manager
Vendor: synology
Actively Exploited
0
CISA KEV List
PoC / Exploits
3
Code Available
Total RCEs
11
Remote Access
Total CVEs
131
Total Indexed
Avg. EPSS
5.83%
Exploit Prob.
Security Vulnerability Index
Page 1 / 14
4.3
CVSS
A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.
Severity: MEDIUM
4.3
CVSS
A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.
Severity: MEDIUM
5.4
CVSS
A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.
Severity: MEDIUM
5.9
CVSS
Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM
5.9
CVSS
Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM
7.2
CVSS
CVE-2024-53286
RCE
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to execute arbitrary code via unspecified vectors.
Severity: HIGH
5.9
CVSS
Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.
Severity: MEDIUM
5.9
CVSS
Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.
Severity: MEDIUM
5.9
CVSS
Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.
Severity: MEDIUM