CVE-2025-25907

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2024-56903

Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as account management. This vulnerability is used in chain with CVE-2024-56901 for a successful CSRF attack...

CVE-2024-56903

Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as account management. This vulnerability is used in chain with CVE-2024-56901 for a successful CSRF attack...

CVE-2024-56903

Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as account management. This vulnerability is used in chain with CVE-2024-56901 for a successful CSRF attack...

CVE-2024-56903

Geovision GV-ASWeb (version 6.1.1.0 and earlier) is vulnerable to a flaw that allows attackers to modify POST request methods to GET against critical functionalities, such as account management. This vulnerability is used in a chain with CVE-2024-56901 to facilitate a successful Cross-Site Reques...

CVE-2025-22219

VMware Aria Operations for Logs is affected by CVE-2025-22219 (stored cross-site scripting). According to the sources, a malicious actor with non-administrative privileges can inject scripts that may lead to arbitrary admin actions. Remediation is available in the fixed version 8.18.3 for Aria Op...

CVE-2025-22219: Improper Neutralization of Input During Web Page Generation

VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges may be able to inject a malicious script that can perform stored cross-site scripting may lead to arbitrary operations as admin user...

CVE-2024-7915

CVE-2024-7915 affects Sensei Mac Cleaner. A local privilege escalation via PID reuse in the XPC-based SenseiHelper allows an attacker to impersonate a legitimate client and invoke arbitrary methods, potentially performing root-level actions. Reported capabilities include arbitrary file deletion/w...

CVE-2024-30157

A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to...

CVE-2024-35286

A vulnerability in NuPoint Messenger NPM of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary...

CVE-2024-35286

The NuPoint Messenger (NPM) component of Mitel MiCollab (versions through 9.8.0.33 ) is vulnerable to a SQL injection attack due to insufficient sanitization of user input. An unauthenticated attacker can exploit this flaw to access sensitive information and perform arbitrary database and managem...

CVE-2024-33377

LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attackers can cause victim users to perform arbitrary operations via interaction with crafted elements on the web page...

CVE-2024-33377

LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attackers can cause victim users to perform arbitrary operations via interaction with crafted elements on the web page...

CVE-2024-33377

LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attackers can cause victim users to perform arbitrary operations via interaction with crafted elements on the web page...

WSO2 Management Console Cross-Site Scripting

The management console of multiple WSO2 products suffer from a Cross-Site Scripting vulnerability : - WSO2 API Manager versions 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, 4.0.0 - WSO2 API Manager Analytics versions 2.2.0, 2.5.0, 2.6.0 - WSO2 API Microgateway version 2.2.0 - WSO2 Data Analytics...

Use-After-Free

chromium is vulnerable to a Use-After-Free. The vulnerability due to improper handling of memory in the WebCodecs component. It allows a remote attacker to execute arbitrary read/write operations via a crafted HTML page...

Cisco Expressway Series Cross-Site Request Forgery Vulnerability (CNVD-2025-06742)

Cisco Expressway Series is an American Cisco software for accessing devices outside the firewall. A cross-site request forgery vulnerability exists in Cisco Expressway Series, which can be exploited by an attacker to perform arbitrary operations...

Cisco Expressway Series 跨站请求伪造漏洞

Cisco Expressway Series is an American Cisco software for accessing devices outside the firewall. A cross-site request forgery vulnerability exists in Cisco Expressway Series, which can be exploited by an attacker to perform arbitrary operations...

CVE-2023-48388

Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service...

PT-2023-30802 · Unknown · Smartstar Software Cws

Name of the Vulnerable Software and Affected Versions: SmartStar Software CWS affected versions not specified Description: The issue is related to missing authorization in the SmartStar Software CWS web-based integration platform. This allows users to access data or perform actions that they shou...