The vulnerability of the Device Admin App operating system ctrlX OS allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Device Admin App on the ctrlX OS platform is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by sending specially crafted HTTP requests...

CVE-2025-34490

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity XXE issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files...

The vulnerability of the FortiIsolator browser isolation platform arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This vulnerability allows attackers to execute arbitrary code.

The vulnerability of the FortiIsolator browser isolation platform exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially created HTTP...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a resource management error vulnerability that stems from a post-release reuse issue, which can be exploited by an attacker to submit a special Web request that can be tricked into being parsed by the user...

The vulnerability of the email notification sending function in Netgear WNR854T router software allows a hacker to execute arbitrary commands.

The vulnerability of the email notification sending function in Netgear WNR854T router microprogramming software is related to the failure to take measures to neutralize special elements used in the operating system’s processing of the emailaddress parameter. Exploiting this vulnerability allows ...

CVE-2023-33302

A buffer copy without checking size of input 'classic buffer overflow' in Fortinet FortiMail webmail and administrative interface version 6.4.0 through 6.4.4 and before 6.2.6 and FortiNDR administrative interface version 7.2.0 and before 7.1.0 allows an authenticated attacker with regular webmail...

The vulnerability of the Cisco AnyConnect VPN server’s microprogramming software in Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateways allows a intruder to trigger a service failure.

The vulnerability of the Cisco AnyConnect VPN server in the microprogramming software for Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateways is related to a reallocation of memory. Exploiting this vulnerability could allow an attacker to cause service interruptions by sending specially...

LoLLMs Web UI 安全漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs Web UI v9.9 to the latest version, which stems from a directory listing vulnerability that allows an attacker to list arbitrary...

The vulnerability of the openvpn_server_setup() function in the openvpn.cgi scenario of the Wavlink AC3000 (WL-WN533A8) router microprogramming software allows a hacker to circumvent existing security restrictions.

The vulnerability of the openvpnserversetup function in the openvpn.cgi script of the Wavlink AC3000 WL-WN533A8 router software is related to errors in system configuration or settings. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by sending...

The vulnerability of the add_dir() function in the nas.cgi script of the Wavlink AC3000 router’s microprogramming system allows a hacker to circumvent existing security restrictions.

The vulnerability of the adddir function in the nas.cgi script of the Wavlink AC3000 WL-WN533A8 router microprogramming system is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to bypass existing security...

The vulnerability of the sch_reboot() function in the adm.cgi script of the Wavlink AC3000 (WL-WN533A8) router’s microprogramming system allows a hacker to execute arbitrary commands.

The vulnerability of the schreboot function in the adm.cgi script of the Wavlink AC3000 WL-WN533A8 router’s microprogramming system is related to the lack of measures taken to manage data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by...

The vulnerability of the web interface of NAKIVO Backup and Replication systems for virtual machines allows a perpetrator to disclose protected information.

The vulnerability of the web interface of NAKIVO Backup and Replication systems for virtual machines involves access control deficiencies. Exploiting this vulnerability allows an attacker to disclose protected information by sending specially crafted HTTP requests...

The vulnerability of the openvpn_server_setup() function in the openvpn.cgi scenario of the Wavlink AC3000 (WL-WN533A8) router microprogramming software allows a hacker to circumvent existing security restrictions.

The vulnerability of the openvpnserversetup function in the openvpn.cgi script of the Wavlink AC3000 WL-WN533A8 router software is related to errors in system configuration or settings. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by sending...

Google Chrome 缓冲区错误漏洞

Google Chrome is a WEB browser developed by Google Inc. A security vulnerability exists in Google Chrome, which can be exploited by remote attackers to submit a special Web request that can be tricked into being parsed by the user, which can crash the application or execute arbitrary code in the...

The vulnerability of the set_ftp_cfg() function in the nas.cgi script of the Wavlink AC3000 router’s microprogramming system allows a hacker to circumvent existing security restrictions.

The vulnerability of the setftpcfg function in the nas.cgi script of the Wavlink AC3000 WL-WN533A8 router’s microprogramming system is related to errors in system configuration or settings. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by sending...

Google chrome 安全漏洞

Google Chrome is a WEB browser developed by Google Inc. A heap overflow vulnerability exists in the Google Chrome GPU, which can be exploited by a remote attacker to submit a special web request, which induces the user to parse it and can be used to execute arbitrary code in the application conte...

The vulnerability of the proxy server of the Fortinet FortiManager device management software, as well as the FortiAnalyzer security event monitoring and analysis tools, allows a perpetrator to execute arbitrary codes or commands.

The vulnerability of the proxy server of the Fortinet FortiManager device management software, as well as the FortiAnalyzer event monitoring and analysis tools, relates to an escape from the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or...

CVE-2025-26352

A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests...

CVE-2025-26346

A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'" in maxprofile/menu/model.lua editUserGroupMenu endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP...

Q-Free MAXTIME Suite 安全漏洞

Q-Free MAXTIME Suite is a software suite for local traffic signal management from Q-Free. A security vulnerability exists in Q-Free MAXTIME Suite version 2.11.0 and prior versions that originates from a missing authorization in maxprofile/user-groups/routes.lua. An attacker exploiting this...