CVE-2017-7280

An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not properly filtered before being sent to a popen function. This allows for remote code execution by sending a specially crafted user variable.

• CWE-20

• https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-1/Exploit, Third Party Advisory
• https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-1/Exploit, Third Party Advisory

Published

Apr 12, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7274The r_pkcs7_parse_cms function in libr/util/r_pkcs7.c in rad…
• CVE-2017-7275The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0…
• CVE-2017-7276There is reflected XSS in TOPdesk before 5.7.6 and 6.x and 7…
• CVE-2017-7277The TCP stack in the Linux kernel through 4.10.6 mishandles …
• CVE-2017-7278Unspecified vulnerability in ASSA ABLOY APTUS Styra Porttele…
• CVE-2017-7279An unprivileged user of the Unitrends Enterprise Backup befo…
• CVE-2017-7281An issue was discovered in Unitrends Enterprise Backup befor…
• CVE-2017-7282An issue was discovered in Unitrends Enterprise Backup befor…
• CVE-2017-7283An authenticated user of Unitrends Enterprise Backup before …
• CVE-2017-7284An attacker that has hijacked a Unitrends Enterprise Backup …
• CVE-2017-7285A vulnerability in the network stack of MikroTik Version 6.3…
• CVE-2017-7286Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…