PT-2025-39669

Name of the Vulnerable Software and Affected Versions Aranda PassRecovery version 1.0 Description An issue allows attackers to enumerate valid user accounts in Active Directory. This is achieved by sending a crafted POST request to the /user/existdirectory/1 API endpoint. The POST request allows...

The vulnerability of the strcpy() function in D-Link DCS-935L wireless HD cameras’ microprogramming software allows a intruder to execute arbitrary code.

The vulnerability of the strcpy function in D-Link DCS-935L wireless HD cameras’ microprogramming software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted POST...

CVE-2025-57296

Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCfg web interface. When handling the list and vlanId parameters, the subADBC0 helper function concatenates these user-supplied values into...

CVE-2025-57296

Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCfg web interface. When handling the list and vlanId parameters, the subADBC0 helper function concatenates these user-supplied values into...

Remote Code Execution (RCE)

flowise is vulnerable to Remote Code Execution RCE. The vulnerability is due to unsafe use of a dynamic Function constructor due to user-controlled input being executed, allowing attackers to run arbitrary JavaScript via a crafted POST request...

CVE-2025-56752

A vulnerability in the Ruijie RG-ES series switch firmware ESW1.01B1P39 enables remote attackers to fully bypass authentication mechanisms, providing them with unrestricted access to alter administrative settings and potentially seize control of affected devices via crafted HTTP POST request to...

Linux Distros Unpatched Vulnerability : CVE-2019-3993

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by...

Linux Distros Unpatched Vulnerability : CVE-2022-2456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15....

Linux Distros Unpatched Vulnerability : CVE-2022-41444

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross Site Scripting XSS vulnerability in Cacti 1.2.21 via crafted POST request to graphsnew.php. CVE-2022-41444 Note that Nessus relies on the presence of the...

CVE-2025-55521

An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2025-55521

An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2025-55521

An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2025-55521

An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2025-55521

This CVE affects Akaunting v3.1.18, with the vulnerability located in the /settings/localisation component. A crafted POST request can trigger a Denial of Service when authenticated. The public documents do not specify a fixed version; PT-2025-34253 notes no available fix at that time. Monitor fo...

CVE-2025-50902

CVE-2025-50902 describes a CSRF vulnerability in the old-peanut Open-Shop project (aka old-peanut/wechat_applet__open_source) up to version 1.0.0. The underlying issue is a CSRF flaw that could allow an attacker to obtain sensitive information via crafted HTTP POST requests. Affected software is ...

PT-2025-33282 · Kuwfi · Kuwfi Gc111

Name of the Vulnerable Software and Affected Versions: KuWFi GC111 versions GC111-GL-LM321 V3.0 20191211 Description: The KuWFi GC111 device is susceptible to unauthorized command execution. A crafted POST request to the /goform/goform set cmd process API endpoint, utilizing the SSID parameter,...

The vulnerability of the setRIP() function in the mod_form.so script of Linksys routers such as RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 allows a hacker to execute arbitrary code or cause service failures.

The vulnerability of the setRIP function in the modform.so script of Linksys routers such as RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 lies in the fact that the output of the operation goes beyond the buffer in memory when processing parameters like RIPmode and RIPpasswd. Exploiting this...

The vulnerability of the wirelessBasic() function in the mod_form.so script of Linksys routers such as RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the wirelessBasic function in the modform.so microprogramming system for Linksys routers such as RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 lies in the fact that the operation’s output escapes the buffer in memory when processing the submitSSID1 parameter. Exploiting...

The vulnerability of the um_rp_autochannel() function in the microprogramming software for Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 allows a hacker to execute arbitrary code.

The vulnerability of the umrpautochannel function in the microprogramming software for Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 lies in the fact that the operation’s output escapes the buffer and is stored in memory when processing the apcliAuthMode2G and apcliAuthMode5G...

The vulnerability in the setup.cgi script of Netgear DGN1000B router software allows a hacker to execute arbitrary commands.

The vulnerability in the setup.cgi script of Netgear DGN1000B router microprogramming software relates to the failure to take measures to neutralize special elements used in the operating system’s command for handling the TimeToLive parameter. Exploiting this vulnerability allows a remote attacke...