804 matches found
Mercury MR816v2 安全漏洞
The Mercury MR816v2 is an access control device from Mercury China. A security vulnerability exists in Mercury MR816v2 081C3114 version 4.8.7 Build 110427 Rel 36550n, which originates from stored cross-site scripting and could lead to the disclosure of an administrator's session and the execution...
CVE-2025-65289
A stored Cross site scripting XSS vulnerability in the Mercury MR816v2 081C3114 4.8.7 Build 110427 Rel 36550n router allows a remote attacker on the LAN to inject JavaScript into the router's management UI by submitting a malicious hostname. The injected script is stored and later executed in the...
EUVD-2025-201713
phpIPAM v1.7.3 contains a Cross-Site Request Forgery CSRF vulnerability in the database export functionality. The generate-mysql.php function, located in the /app/admin/import-export/ endpoint, allows remote attackers to trigger large database dump downloads via crafted HTTP GET requests if an...
CVE-2025-65271
A Client-side template injection (CSTI) vulnerability exists in the Azuriom CMS admin dashboard in versions prior to 1.2.7 . The flaw occurs because certain dashboard components, including widgets, plugins, and admin panels , render untrusted user input without proper sanitization. This allows a ...
CVE-2025-60912
phpIPAM v1.7.3 contains a Cross-Site Request Forgery CSRF vulnerability in the database export functionality. The generate-mysql.php function, located in the /app/admin/import-export/ endpoint, allows remote attackers to trigger large database dump downloads via crafted HTTP GET requests if an...
PT-2025-50085
Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions 2024 SU4 and below Description Ivanti Endpoint Manager contains a critical stored cross-site scripting XSS flaw that allows a remote, unauthenticated attacker to execute arbitrary JavaScript code in the context...
CVE-2025-60912
phpIPAM v1.7.3 is vulnerable to a Cross-Site Request Forgery (CSRF) in its database export functionality. Specifically, the generate-mysql.php function within the /app/admin/import-export/ endpoint lacks sufficient CSRF protection. This flaw allows a remote attacker to trigger the download of lar...
CVE-2025-65271
Client-side template injection CSTI in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard components that render untrusted user input, potentially enabling privilege...
CVE-2025-60912
phpIPAM v1.7.3 contains a Cross-Site Request Forgery CSRF vulnerability in the database export functionality. The generate-mysql.php function, located in the /app/admin/import-export/ endpoint, allows remote attackers to trigger large database dump downloads via crafted HTTP GET requests if an...
PT-2025-49587
Name of the Vulnerable Software and Affected Versions Azuriom CMS versions prior to 1.2.7 Description A client-side template injection CSTI issue exists in the Azuriom CMS admin dashboard. A low-privilege user can execute arbitrary template code within the context of an administrator's session...
CVE-2025-65271
Client-side template injection CSTI in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard components that render untrusted user input, potentially enabling privilege...
Exploit for CVE-2025-65271
CVE-2025-65271 PoC for CVE-2025-65271 How to run? node serv...
EUVD-2025-201296
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WatchGuard Fireware OS allows Stored XSS via the IPS module. This vulnerability requires an authenticated administrator session to a locally managed Firebox. This issue affects Firebox: from...
PT-2025-49123
A vulnerability has been identified in Genexis Platinum P4410 router Firmware P4410-V2–1.41 that allows a local network attacker to achieve Remote Code Execution RCE with root privileges. The issue occurs due to improper session invalidation after administrator logout. When an administrator logs...
📄 phpIPAM 1.4 SQL Injection
phpIPAM version 1.4 suffers from a remote SQL injection vulnerability in order.php. This version is also known to suffer from other vectors of attack for the same issue. Exploit Title: phpIPAM 1.4 - SQL Injection Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage:...
EUVD-2025-200080
Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation...
Cross-site Scripting (XSS)
Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Accessory Checkout "Notes" field. An attacker can execute arbitrary JavaScript code in the context of an administrator's session by injectin...
GHSA-FWW5-M9WC-JCJC Snipe-IT is vulnerable to stored cross-site scripting
Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation...
Snipe-IT is vulnerable to stored cross-site scripting
Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation...
