PYSEC-2023-293

An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to the lack of any authentication method, resulting in the alteration or creation of users...

PT-2023-36078 · Repox · Repox

Name of the Vulnerable Software and Affected Versions: Repox affected versions not specified Description: An authentication bypass issue has been found, allowing a remote user to send a specially crafted POST request to alter or create users due to the lack of any authentication method...

The vulnerability of the SetSmartQoSSettings.php script in D-Link DIR-846 router software allows a hacker to execute arbitrary commands.

The vulnerability of the SetSmartQoSSettings.php script of the D-Link DIR-846 router operating system is related to the restoration of unreliable data in memory due to the failure to eliminate certain elements during the processing of parameters smartqoosexpressdevices and smartqoosnormaldevices...

The vulnerability of the `show_zysync_server_contents` function in the network storage software Zyxel NAS326 and NAS542 allows a hacker to execute arbitrary code.

The vulnerability of the showzysyncservercontents function in Zyxel NAS326 and NAS542 software exists because measures to neutralize special elements used in operating system commands have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending...

The vulnerability of the OpenCMS content management system lies in the improper limitation of XML links to external objects, which allows attackers to execute arbitrary code by sending a specially crafted POST request.

The vulnerability of the OpenCMS content management system is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted POST request remotely...

VulnCheck KEV: CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

VulnCheck KEV: CVE-2021-35327

A vulnerability in TOTOLINK A720R A720RFirmware v4.1.5cu.470B20200911 allows attackers to start the Telnet service, then login with the default credentials via a crafted POST request...

Potix ZK Framework AuUploader Remote File Disclosure (CVE-2022-36537)

The version of Potix ZK Framework detected on the remote host is prior to 8.6.4.2, 9.0.1.3, 9.5.1.4, 9.6.0.2, or 9.6.2. If is, therefore, affected by a remote file disclosure vulnerability: - ZK Framework allows attackers to access sensitive information via a crafted POST request sent to the...

SUSE CVE-2020-25715

A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting XSS attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity...

The vulnerability of the software for creating wireless routers based on Debian RaspAP, related to the lack of measures taken to clean data at the management level, allows a hacker to execute arbitrary commands.

The vulnerability of the software for creating wireless routers based on Debian RaspAP is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially crafted POST request with t...

CVE-2023-45985

TOTOLINK X5000R V9.1.0u.6118B20201102 and TOTOLINK A7000R V9.1.0u.6115B20201022 were discovered to contain a stack overflow in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2023-45985

TOTOLINK X5000R V9.1.0u.6118B20201102 and TOTOLINK A7000R V9.1.0u.6115B20201022 were discovered to contain a stack overflow in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

Zebra Technologies Industrial Printers Security Breach

Zebra Technologies Industrial Printers is an industrial printer from Zebra Technologies. A security vulnerability exists in Zebra Technologies Industrial Printers that could allow an attacker to change the username and password of a web page by sending a specially crafted POST request to the...

The vulnerability of the microprogramming software of Advantech EKI-1524, EKI-1522, and EKI-1521 allows a perpetrator to execute arbitrary commands.

The vulnerability of microprogrammed software in the serial interface servers of Advantech EKI-1524, EKI-1522, and EKI-1521 exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

Design/Logic Flaw

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-37759

Incorrect access control in the User Registration page of Crypto Currency Tracker CCT before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request...

Improper access control

Incorrect access control in the User Registration page of Crypto Currency Tracker CCT before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request...