CVE-2025-25928

A Cross-Site Request Forgery CSRF in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF...

Linux Distros Unpatched Vulnerability : CVE-2024-1681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a...

CVE-2025-25760

A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...

CVE-2025-25760

A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...

CVE-2025-25760

A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...

CVE-2024-53542

The CVE-2024-53542 entry concerns NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus (v8.x to v8.6). The issue is an incorrect access control in the /iclock/Settings?restartNCS=1 endpoint that allows an attacker to arbitrarily restart the NCServiceManger via a crafted GET request. Public sources...

The vulnerability of the verify_url_valid() function in the Activitypub-Federation framework, a platform for creating and managing communities in the Lemmy ecosystem, allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the verifyurlvalid function in the Activitypub-Federation framework, a platform for creating and managing communities in the Lemmy community, is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow an attacker to bypass...

The vulnerability of the log.php script in the CMSimple content management system allows a hacker to gain unauthorized access to protected information and execute arbitrary code.

The vulnerability of the CMSimple content management system is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by sending a specially crafted GET request...

The vulnerability of the /htdocs/web/getcfg.php file in the D-Link DIR-815 router’s microprogramming software allows a hacker to access confidential information.

The vulnerability of the /htdocs/web/getcfg.php file in the D-Link DIR-815 router microprogramming system is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to disclose confidential information through a specially crafted GET request...

CVE-2024-44893

An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request...

14Finger Security Vulnerability

14Finger is a full-featured Web fingerprint recognition and sharing platform by b1ackc4t individual developers. A security vulnerability exists in 14Finger version 1.1, which stems from the /api/admin/user component that allows an attacker to access all user information via a crafted GET request...

CVE-2024-37767

CVE-2024-37767 affects 14Finger v1.1. The issue is insecure permissions in the component "/api/admin/user", enabling an attacker to access all user information via a crafted GET request. Reported across multiple sources (NVD, Red Hat, OSV, CNNVD, CVEs lists). The underlying problem is improper ac...

CVE-2024-37767

Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request...

CVE-2024-33383

Arbitrary File Read vulnerability in novel-plus 4.3.0 and before allows a remote attacker to obtain sensitive information via a crafted GET request using the filePath parameter...

CVE-2024-33383

The CVE-2024-33383 case concerns novel-plus versions 4.3.0 and earlier, with an Arbitrary File Read via a crafted GET request that uses the filePath parameter to expose sensitive data. Affected component is the application’s filePath-handling path; root cause is improper validation/handling of fi...

SpringBlade 安全漏洞

Breed Network Technology SpringBlade is a suite of microservice development platforms from China's Breed Network Technology. A security vulnerability exists in SpringBlade version 3.7.1, which stems from a vulnerability that allows an attacker to obtain sensitive information via a crafted GET...

CVE-2023-31889

An issue discovered in httpd in ASUS RT-AC51U with firmware version up to and including 3.0.0.4.380.8591 allows local attackers to cause a denial of service via crafted GET request...

CVE-2023-31889

CVE-2023-31889 affects ASUS RT-AC51U with firmware versions up to 3.0.0.4.380.8591. The issue is an HTTPD service vulnerability allowing local attackers to cause a denial of service via a crafted GET request. Connected sources confirm the affected product and impact as described; there is no deta...

CVE-2023-31889

An issue discovered in httpd in ASUS RT-AC51U with firmware version up to and including 3.0.0.4.380.8591 allows local attackers to cause a denial of service via crafted GET request...

ASUS RT-AC51U 安全漏洞

The ASUS RT-AC51U is a wireless router from Asus China. A security vulnerability exists in ASUS RT-AC51U 3.0.0.4.380.8591 and earlier versions, which originates from a vulnerability that allows a local attacker to cause a denial of service via a crafted GET request...