https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-40895.htmlhttps://patchthecve.com/cve/CVE-2022-40895.htmlWed, 17 Jun 2026 05:02:12 +0000CRITICAL 9.1: In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability. The vulnerability is due to insecure design, where a difference in forgot password utilityhttps://patchthecve.com/cve/CVE-2021-26753.htmlhttps://patchthecve.com/cve/CVE-2021-26753.htmlWed, 17 Jun 2026 03:43:46 +0000CRITICAL 9.9: NeDi 1.9C allows an authenticated user to inject PHP code in the System Files function on the endpoint /System-Files.php via the txt HTTP POST parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data.https://patchthecve.com/cve/CVE-2021-26752.htmlhttps://patchthecve.com/cve/CVE-2021-26752.htmlWed, 17 Jun 2026 03:43:46 +0000HIGH 8.8: NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.php via the md or ag HTTP GET parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data.https://patchthecve.com/cve/CVE-2021-26751.htmlhttps://patchthecve.com/cve/CVE-2021-26751.htmlWed, 17 Jun 2026 03:43:46 +0000HIGH 8.8: NeDi 1.9C allows an authenticated user to perform a SQL Injection in the Monitoring History function on the endpoint /Monitoring-History.php via the det HTTP GET parameter. This allows an attacker to access all the data in the database and obtain access to the NeDi application.https://patchthecve.com/cve/CVE-2020-15035.htmlhttps://patchthecve.com/cve/CVE-2020-15035.htmlWed, 17 Jun 2026 02:55:56 +0000MEDIUM 5.4: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Map.php hde parameter.https://patchthecve.com/cve/CVE-2020-15034.htmlhttps://patchthecve.com/cve/CVE-2020-15034.htmlWed, 17 Jun 2026 02:55:56 +0000MEDIUM 5.4: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Setup.php tet parameter.https://patchthecve.com/cve/CVE-2020-15033.htmlhttps://patchthecve.com/cve/CVE-2020-15033.htmlWed, 17 Jun 2026 02:55:56 +0000MEDIUM 5.4: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the snmpget.php ip parameter.https://patchthecve.com/cve/CVE-2020-15032.htmlhttps://patchthecve.com/cve/CVE-2020-15032.htmlWed, 17 Jun 2026 02:55:56 +0000MEDIUM 5.4: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Incidents.php id parameter.https://patchthecve.com/cve/CVE-2020-15031.htmlhttps://patchthecve.com/cve/CVE-2020-15031.htmlWed, 17 Jun 2026 02:55:56 +0000MEDIUM 5.4: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management.php chg parameter.https://patchthecve.com/cve/CVE-2020-15030.htmlhttps://patchthecve.com/cve/CVE-2020-15030.htmlWed, 17 Jun 2026 02:55:56 +0000MEDIUM 5.4: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Routes.php rtr parameter.https://patchthecve.com/cve/CVE-2020-15029.htmlhttps://patchthecve.com/cve/CVE-2020-15029.htmlWed, 17 Jun 2026 02:55:56 +0000MEDIUM 5.4: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management.php sn parameter.https://patchthecve.com/cve/CVE-2020-15028.htmlhttps://patchthecve.com/cve/CVE-2020-15028.htmlWed, 17 Jun 2026 02:55:56 +0000MEDIUM 5.4: NeDi 1.9C is vulnerable to a cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Map.php xo parameter.https://patchthecve.com/cve/CVE-2020-15037.htmlhttps://patchthecve.com/cve/CVE-2020-15037.htmlWed, 17 Jun 2026 02:55:57 +0000MEDIUM 5.4: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st[] parameter.https://patchthecve.com/cve/CVE-2020-15036.htmlhttps://patchthecve.com/cve/CVE-2020-15036.htmlWed, 17 Jun 2026 02:55:56 +0000MEDIUM 5.4: NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Linked.php dv parameter.https://patchthecve.com/cve/CVE-2020-14414.htmlhttps://patchthecve.com/cve/CVE-2020-14414.htmlWed, 17 Jun 2026 02:54:43 +0000HIGH 8.8: NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload (any system commands) that contains shell metacharacters via a POST request with a pw parameter. (This can also behttps://patchthecve.com/cve/CVE-2020-14413.htmlhttps://patchthecve.com/cve/CVE-2020-14413.htmlWed, 17 Jun 2026 02:54:43 +0000MEDIUM 6.1: NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta= vahttps://patchthecve.com/cve/CVE-2020-14412.htmlhttps://patchthecve.com/cve/CVE-2020-14412.htmlWed, 17 Jun 2026 02:54:43 +0000HIGH 8.8: NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload (any system commands) that contains shell metacharacters via a POST request with a psw parameter. (This https://patchthecve.com/cve/CVE-2020-15017.htmlhttps://patchthecve.com/cve/CVE-2020-15017.htmlWed, 17 Jun 2026 02:55:55 +0000MEDIUM 6.1: NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter.https://patchthecve.com/cve/CVE-2020-15016.htmlhttps://patchthecve.com/cve/CVE-2020-15016.htmlWed, 17 Jun 2026 02:55:55 +0000MEDIUM 6.1: NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the txt GET parameter.