CVE-2025-10397: Server-Side Request Forgery (SSRF)

A vulnerability was identified in Magicblack MacCMS 2025.1000.4050. This affects an unknown part of the component API Handler. The manipulation of the argument cjurl leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly available and might be used...

PT-2025-37408

Name of the Vulnerable Software and Affected Versions: Magicblack MacCMS version 2025.1000.4050 Description: A vulnerability exists in Magicblack MacCMS 2025.1000.4050, specifically within the API Handler component. Manipulation of the cjurl argument can lead to server-side request forgery SSRF...

CVE-2023-33237

TN-5900 Series firmware version v3.3 and prior is vulnerable to improper-authentication vulnerability. This vulnerability arises from inadequate authentication measures implemented in the web API handler, allowing low-privileged APIs to execute restricted actions that only high-privileged APIs ar...

CVE-2022-1609

The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site...

CVE-2025-2356

A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely...

CVE-2025-2335

A vulnerability classified as problematic was found in Drivin Soluções up to 20250226. This vulnerability affects unknown code of the file /api/school/registerSchool of the component API Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated...

CVE-2025-2356

A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely...

CVE-2025-2356 BlackVue App API deviceDelete get request method with sensitive query strings

A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely...

CVE-2025-2356: Use of GET Request Method With Sensitive Query Strings

A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely...

PT-2025-11450

Name of the Vulnerable Software and Affected Versions BlackVue App version 3.65 Description A vulnerability was found in the BlackVue App, affecting the function deviceDelete of the component API Handler. The manipulation leads to the use of the GET request method with sensitive query strings. It...

CVE-2025-2335

A vulnerability classified as problematic was found in Drivin Soluções up to 20250226. This vulnerability affects unknown code of the file /api/school/registerSchool of the component API Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated...

CVE-2025-2335

CVE-2025-2335 affects Drivin Soluções up to 20250226. The vulnerability is an XSS in the API Handler’s /api/school/registerSchool, caused by manipulation of the message argument. It can be exploited remotely and the exploit has been disclosed publicly. Affected component is the API Handler; root ...

CVE-2025-2335 Drivin Soluções API registerSchool cross site scripting

A vulnerability classified as problematic was found in Drivin Soluções up to 20250226. This vulnerability affects unknown code of the file /api/school/registerSchool of the component API Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated...

PT-2025-11375

Name of the Vulnerable Software and Affected Versions Drivin Soluções up to 20250226 Description A vulnerability was found in Drivin Soluções, affecting the /api/school/registerSchool API endpoint of the API Handler component. The manipulation of the message argument leads to cross-site scripting...

CVE-2025-2335: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in Drivin Soluções up to 20250226. This vulnerability affects unknown code of the file /api/school/registerSchool of the component API Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated...

CVE-2025-2124

A vulnerability, which was classified as problematic, was found in Control iD RH iD 25.2.25.0. This affects an unknown part of the file /v2/customerdb/person.svc/changepassword of the component API Handler. The manipulation of the argument message leads to cross site scripting. It is possible to...

CVE-2025-2124

A vulnerability, which was classified as problematic, was found in Control iD RH iD 25.2.25.0. This affects an unknown part of the file /v2/customerdb/person.svc/changepassword of the component API Handler. The manipulation of the argument message leads to cross site scripting. It is possible to...

CVE-2025-2124 Control iD RH iD API change_password cross site scripting

A vulnerability, which was classified as problematic, was found in Control iD RH iD 25.2.25.0. This affects an unknown part of the file /v2/customerdb/person.svc/changepassword of the component API Handler. The manipulation of the argument message leads to cross site scripting. It is possible to...

CVE-2025-2124

CVE-2025-2124 affects Control iD RH iD 25.2.25.0. The issue resides in the API handler, specifically the file path /v2/customerdb/person.svc/change_password, where manipulation of the argument message leads to cross-site scripting. It can be initiated remotely and the exploit has been disclosed p...

PT-2025-10452

Name of the Vulnerable Software and Affected Versions Control iD RH iD version 25.2.25.0 Description A vulnerability was found in the API Handler component of Control iD RH iD, affecting an unknown part of the file /v2/customerdb/person.svc/change password. The manipulation of the message argumen...