Exploit for Code Injection in Ispconfig

CVE-2023-46818 ISPConfig - PHP Code Injection PoC Exploit Ba...

Exploit for Unrestricted Upload of File with Dangerous Type in Boxbilling

CVE-2022-3552 In order to exploit the vulnerability in BoxBli...

JMBroadcast JMB0150 Firmware 安全漏洞

JMBroadcast JMB0150 Firmware is a firmware from JMBroadcast. A security vulnerability exists in JMBroadcast JMB0150 Firmware version v1.0, which stems from improper access control and could lead to the acquisition of hard-coded administrator credentials...

CVE-2025-20178

A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating system. This vulnerability is due to insufficient integrity...

PT-2025-13798 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 7.0.3 Description: A stored XSS vulnerability in the Bronchitis form component of OpenEMR allows attackers to steal credentials from administrators. This issue can be exploited by anyone who can edit a bronchitis for...

CVE-2025-30205

kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrumentation in the optional kanidm patches provided by kandim-provision will cause the provisioned admin credentials to be leaked to the system...

CVE-2025-30205 kanidm-provision leaks provisioned admin credentials into the system log

kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrumentation in the optional kanidm patches provided by kandim-provision will cause the provisioned admin credentials to be leaked to the system...

CVE-2025-30205 kanidm-provision leaks provisioned admin credentials into the system log

kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrumentation in the optional kanidm patches provided by kandim-provision will cause the provisioned admin credentials to be leaked to the system...

CVE-2025-30205

CVE-2025-30205 affects the kanidm-provision helper utility, which uses kanidm’s API to provision users/groups/OAuth2. Before patch 1.2.0, a faulty instrumentation in the optional kanidm patches causes provisioned admin credentials (admin/idm_admin) to be leaked to the system log. Impact is limite...

CVE-2024-11824

A stored cross-site scripting XSS vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. The vulnerability arises because certain HTML tags like and are not disallowed, allowing an attacker to inject malicious HTML into the log via prompts. When an adm...

CVE-2024-11824

A stored cross-site scripting XSS vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. The vulnerability arises because certain HTML tags like and are not disallowed, allowing an attacker to inject malicious HTML into the log via prompts. When an adm...

CVE-2024-11824 Stored XSS in langgenius/dify

A stored cross-site scripting XSS vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. The vulnerability arises because certain HTML tags like and are not disallowed, allowing an attacker to inject malicious HTML into the log via prompts. When an adm...

Vulnerability fixed in Synology DiskStation Manager

Synology has fixed a vulnerability in Synology DiskStation Manager DSM. The vulnerability is located in the LDAP functionality of Synology DiskStation Manager. This vulnerability can be exploited by man-in-the-middle attackers, allowing unauthorized interception of administrator authentication...

Linux Distros Unpatched Vulnerability : CVE-2021-3551

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows...

PT-2025-8940 · Trivision · Trivision Camera Nc227Wf

Name of the Vulnerable Software and Affected Versions: Trivision Camera NC227WF version 5.8.0 Description: An Authentication Bypass issue allows an attacker to retrieve administrator's credentials in cleartext. This is achieved by sending a request to the "/en/player/activex pal.asp" API endpoint...

CVE-2025-20119

A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is du...

Exploit for CVE-2024-9698

CVE-2024-9698 Crafthemes Demo Import " 🔥 Example O...

PT-2025-6146 · Unknown · Quanxun School Affairs System

Name of the Vulnerable Software and Affected Versions: Quanxun School Affairs System affected versions not specified Description: The issue allows unauthenticated attackers to view specific pages and obtain database information as well as plaintext administrator credentials. This exposure of...

Tenda W18E 访问控制错误漏洞

The Tenda W18E is a wireless router from the Chinese company Tenda. An access control error vulnerability exists in the Tenda W18E version 16.01.0.81625, which stems from a faulty access control in the SetQuickcfgWifianDlogin function, and can be exploited by an attacker to make unauthorized...

PT-2025-6095 · Tenda · Tenda W18E

Name of the Vulnerable Software and Affected Versions: Tenda W18E version V16.01.0.81625 Description: A sensitive information disclosure issue in the web management portal allows an unauthenticated remote attacker to retrieve sensitive configuration information, including WiFi SSID, WiFi password...