647 matches found
CVE-2026-24432: Cross-Site Request Forgery (CSRF)
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 lack cross-site request forgery CSRF protections on administrative endpoints, including those used to change administrator account credentials. As a result, an attacker can craft malicious requests that, when triggered b...
Sensitive Information Exposure
wlc is vulnerable to sensitive information exposure. The vulnerability is due to support for unscoped API keys in configuration settings, which allows an attacker to obtain the API key if it is inadvertently sent or exposed to unintended remote servers...
CVE-2021-47830: Cross-Site Request Forgery (CSRF)
GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery CSRF vulnerability. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, can change SMTP configuration settings in the plugin. This may allow unauthorized changes but does not...
CVE-2024-34707
Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the BANNERTOP, BANNERBOTTOM, and BANNERLOGIN configuration settings via the /admin/constance/config/ endpoint. Normally these settings are used to provide custom banner text at...
CVE-2025-1081
A vulnerability was found in Bharti Airtel Xstream Fiber up to 20250123. It has been rated as problematic. This issue affects some unknown processing of the component WiFi Password Handler. The manipulation leads to use of weak credentials. The attack needs to be done within the local network. Th...
CVE-2019-12510
In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API "/soap/serversa" by supplying a malicious X-Forwarded-For header of the device's LAN IP address 192.168.1.1 in every request. As a result, an attacker may...
CVE-2025-1341
A vulnerability, which was classified as problematic, was found in PMWeb 7.2.0. This affects an unknown part of the component Setting Handler. The manipulation leads to weak password requirements. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The...
CVE-2019-25257
CVE-2019-25257 affects LogicalDOC Enterprise 7.7.4. The vulnerability arises from insufficient validation of binary paths when modifying system settings, allowing authenticated users to manipulate configuration parameters (e.g., antivirus.command, ocr.Tesseract.path) to execute arbitrary OS comma...
CVE-2019-25257 LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation
LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying configuration parameters like antivirus.command,...
EUVD-2025-204352
A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form redirect URL configuration. This allows malicious scripts to execute in users' browsers through unvalidated form configuration settings...
Master IP CAM credentials
MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers toobtain sensitive information via a crafted HTTP request, as demonstrated by the username, password, and configuration settings. from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...
EUVD-2025-197845
Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability via the experimental 'Natural Language Queries' feature. Configuration values for this feature are read from the application settings and incorporated into a system command without adequate...
EUVD-2020-24023
Malware in sbrugna...
EUVD-2018-17507
Malware in sbrugna...
EUVD-2020-6640
Malware in sbrugna...
EUVD-2015-3109
Malware in sbrugna...
EUVD-2020-28461
Malware in sbrugna...
EUVD-2020-4825
Malware in sbrugna...