CVE-2021-27132Critical· 9.8▾ AbyssalPoC availableSerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 3.3 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
16%
Nuclei ×1
16% → 16%
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
agcombo_vd625_firmware = agsot_2.1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-29383Low· 3.3In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger)
CVE-2023-27533High· 8.8A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation
CVE-2025-11077High· 7.3A vulnerability was determined in Campcodes Online Learning Management System 1.0
CVE-2025-10210Medium· 6.3A weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0
CVE-2023-4548Medium· 6.3A vulnerability has been found in SPA-Cart eCommerce CMS 1.9.0.3
CVE-2025-10012Medium· 6.3A security vulnerability has been detected in Portabilis i-Educar up to 2.10