197 matches found
EUVD-2012-6607
Malware in sbrugna...
EUVD-2024-31786
Malicious code in bioql PyPI...
EUVD-2024-31751
Malicious code in bioql PyPI...
EUVD-2023-58074
Malicious code in bioql PyPI...
CVE-2025-61606
WeGIA is affected: open redirect in the control.php endpoint via the nextPage parameter (metodo=listarUmnomeClasse=FuncionarioControle) for versions 3.4.12 and below. This could redirect users to arbitrary external domains, enabling phishing or credential theft as described in the CVE entries. Th...
PT-2025-36965
Name of the Vulnerable Software and Affected Versions: FTP-Flask-python versions through 5173b68 Description: A command injection issue exists in FTP-Flask-python. The /ftp.html endpoint’s "Upload File" action constructs a shell command from the ftp file parameter and executes it using os.system...
CVE-2025-9941
A flaw has been found in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /register.php. Executing manipulation of the argument uimage can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used...
CVE-2025-40702
Cross-Site Scripting XSS vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage ACDH-CH, due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an...
CVE-2025-40702
Cross-Site Scripting XSS vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage ACDH-CH, due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an...
CVE-2025-40702
OpenAtlas v8.9.0 (ACDH-CH) is affected by a Cross‑Site Scripting (XSS) flaw caused by inadequate validation of user input in a POST to the /insert/file endpoint, specifically via the creator and license_holder parameters. Multiple sources (NVD, Red Hat, CVE lists, and OSV) confirm the vulnerabili...
CVE-2025-55583
The CVE-2025-55583 affects D-Link DIR-868L B1 firmware FW2.05WWB02, where the fileaccess.cgi endpoint (/dws/api/UploadFile) accepts a pre_api_arg that is passed to system-level shell execution without sanitization or authentication, enabling unauthenticated remote OS command injection with root p...
CVE-2025-29515
Incorrect access control in the DELTfile.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settings within the device's XML database, including the administrator’s password...
D-Link DSL-7740C 安全漏洞
The D-Link DSL-7740C is a modem from China-based AUO D-Link. An access control error vulnerability exists in the D-Link DSL-7740C DSL7740C.V6.TR069.20211230 version, which stems from improper access control of the DELTfile.xgi endpoint, and can be exploited by an attacker to modify arbitrary...
CVE-2025-29515
CVE-2025-29515 affects D-Link DSL-7740C: the DELT_file.xgi endpoint has improper access control, enabling an attacker to modify arbitrary settings in the device’s XML database, including the administrator password. Affected component is the DELT_file.xgi API, within firmware DSL7740C.V6.TR069.202...
CVE-2025-29515
Incorrect access control in the DELTfile.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settings within the device's XML database, including the administrator’s password...
CVE-2012-10061
Sockso Music Host Server versions = 1.5 are vulnerable to a path traversal flaw that allows unauthenticated remote attackers to read arbitrary files from the server’s filesystem. The vulnerability exists in the HTTP interface on port 4444, where the endpoint /file/ fails to properly sanitize...
CVE-2012-10061 Sockso Music Host Server <= 1.5 Path Traversal
Sockso Music Host Server versions = 1.5 are vulnerable to a path traversal flaw that allows unauthenticated remote attackers to read arbitrary files from the server’s filesystem. The vulnerability exists in the HTTP interface on port 4444, where the endpoint /file/ fails to properly sanitize...
CVE-2012-10061
Sockso Music Host Server versions = 1.5 are vulnerable to a path traversal flaw that allows unauthenticated remote attackers to read arbitrary files from the server’s filesystem. The vulnerability exists in the HTTP interface on port 4444, where the endpoint /file/ fails to properly sanitize...
CVE-2012-10061 Sockso Music Host Server <= 1.5 Path Traversal
Sockso Music Host Server versions = 1.5 are vulnerable to a path traversal flaw that allows unauthenticated remote attackers to read arbitrary files from the server’s filesystem. The vulnerability exists in the HTTP interface on port 4444, where the endpoint /file/ fails to properly sanitize...