CVE-2025-57602

Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a shared, hardcoded SSH private key, allows remote attackers to authenticate to the cloud controller, gain interactive shell access, and pivot into other connected IoT devices. This can...

CVE-2025-57602

CVE-2025-57602 affects the AiKaan IoT management platform. The issue stems from insufficient hardening of the proxyuser account and the use of a shared, hardcoded SSH private key, which can allow remote attackers to authenticate to the cloud controller, obtain an interactive shell, and pivot to o...

AiKaan Cloud Controller 安全漏洞

AiKaan Cloud Controller is a monitoring platform for Internet edge devices from AiKaan India. AiKaan Cloud Controller has a security vulnerability that stems from remote endpoint access using a hard-coded SSH private key and username proxyuser, which could allow an attacker to impersonate a manag...

Weitong Mall 授权问题漏洞

Weitong Mall is a shopping mall system developed by fuyanglipengjun. Weitong Mall version 1.0 has an authorization issue vulnerability, the vulnerability stems from improper authorization of the TopicCategoryController function in the file /topiccategory/queryAll, which may lead to remote attacks...

Weitong Mall 授权问题漏洞

Weitong Mall Weitong Mall is a shopping mall system by fuyanglipengjun individual developer. An authorization issue vulnerability exists in Weitong Mall version 1.0, which originates from improper authorization of the TopicController function in the file /topic/queryAll, and could lead to a remot...

PT-2025-39086

Name of the Vulnerable Software and Affected Versions fuyang lipengjun platform version 1.0 Description An issue exists in the TopicController function within the /topic/queryAll file, leading to improper authorization. This can be exploited remotely. The exploit is publicly available...

PT-2025-39085

Name of the Vulnerable Software and Affected Versions fuyang lipengjun platform version 1.0 Description A security issue exists in the fuyang lipengjun platform that results in improper authorization. This affects the UserCouponController function within the /usercoupon/queryAll file. Remote...

openSUSE Security Advisory (SUSE-SU-2025:03278-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-39088

Name of the Vulnerable Software and Affected Versions fuyang lipengjun platform version 1.0 Description An improper authorization issue exists in the TopicCategoryController function within the /topiccategory/queryAll file of the fuyang lipengjun platform. This allows for remote attacks. The...

PT-2025-38731

Name of the Vulnerable Software and Affected Versions AiKaan IoT management platform affected versions not specified Description The AiKaan IoT management platform suffers from inadequate hardening of the proxyuser account and utilizes a shared, hardcoded SSH private key. This combination enables...

PT-2025-39090

Name of the Vulnerable Software and Affected Versions fuyang lipengjun platform version 1.0 Description A flaw exists in the fuyang lipengjun platform that allows for improper authorization. This issue is related to the SysSmsLogController function located in the /sys/smslog/queryAll file. The...

CVE-2025-10766

A weakness has been identified in SeriaWei ZKEACMS up to 4.3. This issue affects the function Download of the file EventViewerController.cs. Executing manipulation of the argument ID can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to t...

CVE-2025-10766

CVE-2025-10766 affects SeriaWei ZKEACMS (≤4.3) and relates to path traversal via the Download function in EventViewerController.cs. The root cause is manipulation of the ID argument, enabling remote exploitation. Public PoC/exploit material has circulated; multiple sources flag remote, low-comple...

CVE-2025-10766 SeriaWei ZKEACMS EventViewerController.cs Download path traversal

A weakness has been identified in SeriaWei ZKEACMS up to 4.3. This issue affects the function Download of the file EventViewerController.cs. Executing manipulation of the argument ID can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to t...

CVE-2025-10764 SeriaWei ZKEACMS Event Action System PendingTaskController.cs Edit server-side request forgery

A vulnerability was identified in SeriaWei ZKEACMS up to 4.3. This affects the function Edit of the file src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs of the component Event Action System. Such manipulation of the argument Data leads to server-side request forgery. The attack may b...

CVE-2025-10764

CVE-2025-10764 affects SeriaWei ZKEACMS up to 4.3, specifically the Edit function in Event Action System at src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs. The vulnerability stems from manipulation of the Data argument, enabling server-side request forgery (SSRF) from remote attacke...

CVE-2025-10764 SeriaWei ZKEACMS Event Action System PendingTaskController.cs Edit server-side request forgery

A vulnerability was identified in SeriaWei ZKEACMS up to 4.3. This affects the function Edit of the file src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs of the component Event Action System. Such manipulation of the argument Data leads to server-side request forgery. The attack may b...

CVE-2025-10762 kuaifan DooTask UsersController.php sql injection

A vulnerability was found in kuaifan DooTask up to 1.2.49. Affected by this vulnerability is an unknown functionality of the file app/Http/Controllers/Api/UsersController.php. The manipulation of the argument keysdepartment results in sql injection. The attack can be executed remotely. The exploi...

CVE-2025-10762

CVE-2025-10762 affects kuaifan DooTask up to version 1.2.49, specifically the file app/Http/Controllers/Api/UsersController.php. The issue arises from manipulation of the argument keys[department], causing an SQL injection. The vulnerability is exploitable remotely and the exploit has been made p...

PT-2025-38660

Name of the Vulnerable Software and Affected Versions SeriaWei ZKEACMS versions prior to 4.4 Description A weakness has been identified in SeriaWei ZKEACMS that allows for path traversal through manipulation of the ID argument in the Download function of the EventViewerController.cs file. This...