CVE-2025-54765

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include...

CVE-2025-54765

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include...

PT-2025-31218

Name of the Vulnerable Software and Affected Versions PuneethReddyHC Online Shopping System Advanced version 1.0 Description A SQL Injection issue exists due to improper sanitization of user-supplied input in the keyword POST parameter of the /action.php API endpoint. Recommendations Apply input...

CVE-2025-54768

The Xorux LPAR2RRD server performance monitoring platform (versions 8.04 and prior ) is vulnerable to an improper access control flaw (CWE-648). An API endpoint intended exclusively for web application administrators is hidden from, but accessible by, lower-level read-only web application users ....

CVE-2025-54768 KL-001-2025-015: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive information...

CVE-2025-54765 KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include...

CVE-2025-54765

The Xorux XorMon-NG infrastructure performance monitoring platform, version 1.8 and prior on Debian , is vulnerable to a privilege escalation flaw (CWE-648 ). An API endpoint intended exclusively for administrators is hidden from but accessible by lower-level read-only web application users. An a...

CVE-2025-54766 KL-001-2025-012: Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensitive Information

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information...

CVE-2025-54766

Xorux XorMon-NG versions 1.8 and prior on Debian are vulnerable to an improper access control flaw (CWE-648 ). An API endpoint intended exclusively for web application administrators is accessible by lower-level read-only web application users. Exploitation allows an attacker to export the applia...

CVE-2025-54766 KL-001-2025-012: Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensitive Information

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information...

PT-2025-31155

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An API endpoint intended for web application administrators is accessible to lower-level read-only users. This allows unauthorized export of the appliance...

PT-2025-31158

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An API endpoint intended for web application administrators is accessible to lower-level read-only users. This allows unauthorized download of appliance...

PT-2025-31156

Name of the Vulnerable Software and Affected Versions affected versions not specified Description An API endpoint intended for web application administrators is accessible to lower-level read-only users. This allows unauthorized access to appliance configuration import functionality, potentially...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the q URL parameter in the /api/v2.0/users endpoint. An attacker can retrieve sensitive password hash and salt values by abusing the filtering capability to extract this information character by character. Note:...

CVE-2025-30086

CNCF Harbor versions 2.13.x before 2.13.1 and 2.12.x before 2.12.4 are vulnerable to an ORM Leak in the /api/v2.0/users endpoint. An attacker with administrator access can abuse the q URL parameter to filter by column, specifically using password=~ to extract user password hash and salt values ch...

PT-2025-30656 · WordPress · Ai Engine

Name of the Vulnerable Software and Affected Versions: AI Engine plugin for WordPress versions through 2.9.4 Description: The AI Engine plugin for WordPress is susceptible to sensitive information exposure. The simpleTranscribeAudio API endpoint does not properly restrict URL schemes before...

PT-2025-30702 · Unknown · Deerwms Deer-Wms-2

Name of the Vulnerable Software and Affected Versions: deerwms deer-wms-2 versions 2.0 through 3.3 Description: A critical issue exists in deerwms deer-wms-2. The vulnerability is due to a SQL injection flaw within an unknown function of the /system/dept/edit API endpoint. The ancestors parameter...

PT-2025-30670 · Tenda · Tenda Ac8V4

Name of the Vulnerable Software and Affected Versions: Tenda AC8V4 version V16.03.34.06 Description: The Tenda AC8V4 device contains a stack overflow issue at the /goform/SetSysTimeCfg API endpoint. Manipulation of the timeZone and timeType parameters leads to a stack-based buffer overflow...

PT-2025-30682 · Tenda · Tenda Ac8V4

Name of the Vulnerable Software and Affected Versions: Tenda AC8V4 version V16.03.34.06 Description: The device contains a heap overflow at the /goform/GetParentControlInfo API endpoint. Manipulation of the mac parameter leads to a heap-based buffer overflow. Recommendations: Apply a newer versio...

PT-2025-30453 · Alertenterprise · Alertenterprise Guardian

Name of the Vulnerable Software and Affected Versions: AlertEnterprise Guardian version 4.1.14.2.2.1 Description: An issue allows for privilege escalation to administrator privileges via manipulation of the IsAdminApprover parameter within a Request Building Access request submitted through the...