Skip to content
OpenAdvisories

Vendor

Sangfor

21 known vulnerabilities.

Products

Operation and Maintenance Management System 6 Operation and Maintenance Security Management System 6 Net-Gen Application Firewall 4 零信任访问控制系统 aTrust 2 Next-Gen Application Firewall (NGAF) 1 Endpoint Detection and Response Platform 1 Sangfor Behavior Management System (DC Management System) 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-15501

    Sangfor Operation and Maintenance Management System getCmd WriterHandle.getCmd os command injection

    A vulnerability was determined in Sangfor Operation and Maintenance Management System up to 3.0.8. Impacted is the function WriterHandle.getCmd of the file /isomp-protocol/protocol/getCmd. This manipulation of the argument sessionPath causes os command inject…

    Sangfor Operation and Maintenance Management System
  • Critical 9.8
    CVE-2025-15500

    Sangfor Operation and Maintenance Management System HTTP POST Request getHis os command injection

    A vulnerability was found in Sangfor Operation and Maintenance Management System up to 3.0.8. This issue affects some unknown processing of the file /isomp-protocol/protocol/getHis of the component HTTP POST Request Handler. The manipulation of the argument s…

    Sangfor Operation and Maintenance Management System
  • Critical 10.0
    CVE-2025-34041

    Sangfor Endpoint Detection and Response OS Command Injection

    An OS command injection vulnerability exists in the Chinese versions of Sangfor Endpoint Detection and Response (EDR) management platform versions 3.2.16, 3.2.17, and 3.2.19. The vulnerability allows unauthenticated attackers to construct and send malicious H…

    Sangfor Endpoint Detection and Response Platform
  • Critical 9.8
    CVE-2023-30806 EPSS 65%

    Sangfor Next-Gen Application Firewall PHPSESSID Command Injection

    The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /cgi-bin/logi…

    Sangfor Net-Gen Application Firewall
  • Critical 9.8
    CVE-2023-30805 EPSS 65%

    Sangfor Next-Gen Application Firewall Login Un Param Command Injection

    The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /LogInOut.php…

    Sangfor Net-Gen Application Firewall
  • Critical 9.8
    CVE-2023-30803 EPSS 21%

    Sangfor Next-Gen Application Firewall Authentication Bypass

    The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can bypass authentication and access administrative functionality by sending HTTP requests using a craf…

    Sangfor Net-Gen Application Firewall