33 matches found
CVE-2026-10158 TRENDnet TEW-432BRP formPortFw stack-based overflow
A security flaw has been discovered in TRENDnet TEW-432BRP 3.10B20. Affected is the function formPortFw of the file /goform/formPortFw. The manipulation of the argument servername results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released t...
CVE-2026-10158: Stack-based Buffer Overflow
A security flaw has been discovered in TRENDnet TEW-432BRP 3.10B20. Affected is the function formPortFw of the file /goform/formPortFw. The manipulation of the argument servername results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released t...
CVE-2019-25346: Improper Neutralization of Special Elements used in an SQL Command
TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'servername' parameter. Attackers can inject malicious SQL code like ' or '1=1 to retrieve unauthorized database records and potentially access sensitive system information...
CVE-2019-25311: Improper Neutralization of Input During Web Page Generation
thesystem version 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple server data input fields. Attackers can submit crafted script payloads in operatingsystem, systemowner, systemusername, systempassword,...
CVE-2025-62801: Improper Neutralization of Special Elements used in an OS Command
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the servername field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fix...
EUVD-2025-20237
Malicious code in bioql PyPI...
CVE-2025-43930
Hashview 0.8.1 allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...
CVE-2025-43932
JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...
CVE-2025-43933
fblog through 983bede allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...
CVE-2025-43933: External Control of Assumed-Immutable Web Parameter
fblog through 983bede allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...
CVE-2025-43932
The JobCenter application (versions through 7e7b0b2 ) is vulnerable to account takeover via its password reset feature. The root cause is an unconfigured SERVER_NAME , which forces the password reset process to rely on the Host HTTP header . To remediate this, administrators should configure the ...
CVE-2025-43933
The blogging system fblog (versions through 983bede ) is vulnerable to account takeover via its password reset feature. The root cause is an unconfigured SERVER_NAME setting, which forces the reset mechanism to rely on the Host HTTP header . To remediate this, administrators should configure the ...
CVE-2025-43931
flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...
CVE-2025-43932
JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...
CVE-2025-43933
fblog through 983bede allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...
CVE-2025-43931: Weak Password Recovery Mechanism for Forgotten Password
flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...
CVE-2025-43931
The flask-boilerplate framework (versions through a170e7c ) is vulnerable to account takeover via its password reset feature. The root cause is that the SERVER_NAME is not configured, causing the reset process to depend on the Host HTTP header . To remediate this, users should configure the SERVE...
CVE-2025-43930
Hashview version 0.8.1 is vulnerable to account takeover via its password reset feature. The root cause is a misconfiguration where SERVER_NAME is not defined, causing the reset mechanism to rely on the Host HTTP header . An attacker could exploit this to gain unauthorized access to user accounts...
