The vulnerability of the FUN_00425fd8() function (/biurl_grou) of the D-Link DIR-632 router’s microprogramming software allows a hacker to induce a service failure.

The vulnerability of the FUN00425fd8 function /biurlgrou of the D-Link DIR-632 router’s microprogramming system is related to the output of operations that go beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure by sending a specially...

CVE-2012-10033

Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to sanitize the release parameter before passing it to the configureimage function. This function invokes PHP’s passthru with the unsanitize...

The vulnerability in the tmUnblock.cgi script of the wireless router software from Linksys WRT120N allows a intruder to gain unauthorized access to the control web interface.

The vulnerability of the tmUnblock.cgi microprogramming software for wireless routers like Linksys WRT120N is related to buffer overflows in the stack when processing the TMBlockURL parameter. Exploiting this vulnerability allows an attacker to gain unauthorized access to the web-based control...

PT-2025-31980 · Netwin · Surgeftp

Name of the Vulnerable Software and Affected Versions: Netwin SurgeFTP versions 23c8 and earlier Description: Netwin SurgeFTP contains a flaw in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to the surgeftpmgr.c...

CVE-2025-52078

CVE-2025-52078 concerns a file upload vulnerability in Writebot AI Content Generator SaaS React Template (versions through 4.0.0). Connected sources confirm an unauthenticated arbitrary file upload via the /file-upload endpoint (and PoC references suggesting an /upload path) that could enable ele...

CVE-2025-52078

File upload vulnerability in Writebot AI Content Generator SaaS React Template thru 4.0.0, allowing remote attackers to gain escalated privileges via a crafted POST request to the /file-upload endpoint...

Directory Traversal

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Directory Traversal via the addcrypted endpoint when processing the package parameter. An attacker can achieve arbitrary file write and execute malicious co...

CVE-2025-25692

A PHAR deserialization vulnerability in the getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2013-10035

A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPageAjax.php, and casesSchedulerGetPlugins.php, by supplying...

CVE-2025-25692

CVE-2025-25692 affects PrestaShop v8.2.0 with a PHAR deserialization vulnerability in the _getHeaders function. A crafted POST request can lead to arbitrary code execution. The incident is tied to the getHeaders implementation in PrestaShop’s codebase, enabling an attacker to run code on the serv...

The vulnerability of the AutoGRAPH Web monitoring software platform lies in its lack of measures to protect the structure of web pages, allowing attackers to execute arbitrary code.

The vulnerability of the AutoGRAPH Web monitoring software platform lies in the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted POST request...

The vulnerability of the built-in web server boa (/boafrm/formIpQoS) of TOTOLINK A702R router’s microprogramming software allows a intruder to cause a service failure.

The vulnerability of the built-in web server boa /boafrm/formIpQoS of TOTOLINK A702R router software is related to the issue of the operation exceeding the buffer in memory when processing the mac parameter. Exploiting this vulnerability allows a malicious actor to cause service failure by sendin...

The vulnerability of the built-in boa server (/boafrm/formMapDel) of the TOTOLINK X15 router’s microprogramming software allows a hacker to cause a service failure.

The vulnerability of the built-in server boa /boafrm/formMapDel of the TOTOLINK X15 router microprogramming software is related to the issue of the operation exceeding the buffer boundaries in memory when processing the parameter devicemac1. Exploiting this vulnerability allows a remote attacker ...

The vulnerability of the built-in web server boa (/boafrm/formOneKeyAccessButton) of the TOTOLINK A702R router’s microprogramming software allows a intruder to trigger a service failure.

The vulnerability of the built-in web server boa /boafrm/formOneKeyAccessButton of the TOTOLINK A702R router’s microprogramming software is related to the issue of data being written outside the buffer in memory when processing the submit-url parameter. Exploiting this vulnerability allows a...

The vulnerability of the formSetIptv() function in the microprogramming software for the Tenda AX1803 allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the formSetIptv function in the microprogramming software for the Tenda AX1803 router is related to buffer overflows in the stack during the processing of the adv.iptv.stballvlans parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a...

The vulnerability of the formSetAPCfg() function (/goform/setWtpData) in the Tenda AC500 router’s microprogramming software allows a hacker to execute arbitrary code or cause service failures.

The vulnerability of the formSetAPCfg/goform/setWtpData function in the Tenda AC500 router’s microprogramming software is related to the issue of the operation exceeding the buffer boundaries in memory when processing the parameter radio2g1. Exploiting this vulnerability could allow a remote...

CVE-2025-41677

A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession...

The vulnerability of the setDiagnosisCfg() function in the cstecgi.cgi script of the mesh-system TOTOLink T6 software allows a intruder to execute arbitrary code.

The vulnerability of the setDiagnosisCfg function in the cstecgi.cgi script of the mesh-system TOTOLink T6 software is related to the issue of the operation exceeding the buffer boundaries in memory when processing the ip parameter. Exploiting this vulnerability allows a remote attacker to execut...

The vulnerability of the fromWizardHandle()/goform/WizardHandle function in the Tenda FH451 router software allows a hacker to induce a service failure.

The vulnerability of the fromWizardHandle/goform/WizardHandle function in the Tenda FH451 router’s microprogramming system is related to reading data beyond the buffer boundaries in memory when processing the PPW parameter. Exploiting this vulnerability can allow a malicious actor to cause servic...

MB Connect Line mbNET.mini 资源管理错误漏洞

The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. A resource management error vulnerability exists in MB CONNECT LINE mbNET.mini that originates from exhausting critical...