CVE-2025-8812

A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /api/settings of the component Admin Panel. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-8812: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /api/settings of the component Admin Panel. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3471 SureForms < 1.4.4 - Contributor+ Settings Update

The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action...

Mautic allows Improper Authorization in Reporting API

Summary This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data. Improper Authorization: An authorization flaw exists in Mautic's API Authorization implementation. Any...

PT-2024-16167 · WordPress · Ce21 Suite

Name of the Vulnerable Software and Affected Versions: CE21 Suite plugin for WordPress versions up to, and including, 2.2.0 Description: The issue is related to unauthorized modification of data due to a missing capability check on the ce21 single sign on save api settings function. This allows...

VMware vCenter API Settings

Binary data vmwarevspherevcentersettings.nbin...

VulnCheck KEV: CVE-2020-27986

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it...

CVE-2023-20194

A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This...

CVE-2023-20194

Cisco ISE ERS API vulnerability (CVE-2023-20194) allows an authenticated Administrator to read arbitrary OS files due to improper privilege management in the ERS API. Exploitation requires valid admin privileges and a crafted ERS API request; impact is information disclosure and potential privile...

CVE-2023-4613

LG LED Assistant is affected by CVE-2023-4613, a path traversal vulnerability in the /api/settings/upload endpoint. The flaw stems from inadequate validation of a user-supplied path used in file operations, enabling remote attackers to execute arbitrary code in the current user context. Public de...

LG LED Assistant upload Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/settings/upload endpoint. The issue results from the lack of proper validation...

CVE-2021-46006

In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication...

CVE-2020-27986

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it...

PT-2020-16890 · Sonarsource · Sonarqube

Name of the Vulnerable Software and Affected Versions: SonarQube version 8.4.2.36762 Description: The issue allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the "api/settings/values" URI. The vendor's position is that it is the administrator's responsibility to...

CVE-2020-27986: Missing Authentication for Critical Function

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it...

piSignage 2.6.4 - Directory Traversal Vulnerability

Exploit for hardware platform in category web applications Exploit Title: piSignage 2.6.4 - Directory Traversal Exploit Author: JunYeong Ko Vendor Homepage: https://pisignage.com/ Version: piSignage before 2.6.4 Tested on: piSignage before 2.6.4 CVE : CVE-2019-20354 Summary: The web application...

CVE-2019-20354: Improper Limitation of a Pathname to a Restricted Directory

The web application component of piSignage before 2.6.4 allows a remote attacker authenticated as a low-privilege user to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download...

PT-2020-10393

Name of the Vulnerable Software and Affected Versions piSignage versions prior to 2.6.4 Description The issue allows a remote attacker, authenticated as a low-privilege user, to download arbitrary files from the Raspberry Pi. This is achieved through a path traversal vulnerability in the...

PT-2019-12319

Name of the Vulnerable Software and Affected Versions Django CRM version 0.2.1 Description The issue affects the Django CRM, where multiple CSRF problems exist. These issues are found in various API endpoints, including "/change-password-by-admin/", "/api/settings/add/", "/cases/create/",...

CVE-2018-8096

Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass with the attacker obtaining admin access via '"Name":"isauthenticationenabled","Value":false' in an api/settings/setting-isauthenticationenabled PUT request...