CVE-2026-26449

In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference or access to invalid memory while processing the frame, causing the process to crash...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from an error in the xfrm6rcvencap function within ipv6 xfrm6. This error fails to release the dst...

EUVD-2019-20050

AnyBurn 4.3 x86 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string to the image conversion function. Attackers can paste a large buffer into the source or destination image file fields and click Convert Now to...

CVE-2026-27728

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in NetworkPathMonitor.performTraceroute allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell...

CVE-2025-34314

IPFire

CVE-2023-49254

Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, howeve...

Design/Logic Flaw

Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, howeve...

CVE-2023-49254 Command injection in the network test tools

Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, howeve...

CVE-2023-49254: Improper Neutralization of Special Elements used in an OS Command

Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, howeve...

PT-2024-13711 · Hongdian · H8951-4G-Esp +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: An authenticated user can execute arbitrary commands in the context of the root user by providing a payload in the destination field of the network test...

CVE-2022-42992

Multiple stored cross-site scripting XSS vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Train Code, Train Name, and Destination text fields...

CVE-2022-42992

Multiple stored cross-site scripting XSS vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Train Code, Train Name, and Destination text fields...

PT-2022-26699

Name of the Vulnerable Software and Affected Versions Train Scheduler App version 1.0 Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Train Code, Train Name, and Destination text fields. This enables the execution of maliciou...

CVE-2022-0701

The SEO 301 Meta WordPress plugin through 1.9.1 does not escape its Request and Destination settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2020-8951: Improper Neutralization of Input During Web Page Generation

Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the Source or Destination field of the Configuration Manager Configuration Parameter Translation page...

Cross site scripting

Cross-site scripting XSS vulnerability in the Migrate module 7.x-2.x before 7.x-2.8 for Drupal, when the migrateui submodule is enabled, allows user-assisted remote attackers to inject arbitrary web script or HTML via a destination field label...

PT-2015-6966

Name of the Vulnerable Software and Affected Versions Drupal Migrate module versions 7.x-2.x before 7.x-2.8 Description A cross-site scripting XSS issue exists, allowing user-assisted remote attackers to inject arbitrary web script or HTML via a destination field label when the migrate ui submodu...

CVE-2015-5514: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Migrate module 7.x-2.x before 7.x-2.8 for Drupal, when the migrateui submodule is enabled, allows user-assisted remote attackers to inject arbitrary web script or HTML via a destination field label...