CVE-2026-117538 REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF...

CVE-2026-117538

REDAXO versions before 5.21.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability within the backend packages API . The root cause is the lack of HTML escaping when a function parameter is concatenated into an error message. An attacker can trick an authenticated backend user i...

PT-2026-126373

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF...

FineCMS <=5.0.10 - Cross-Site Scripting Detection

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. !/usr/bin/env python3 -- coding: utf-8 -- """FineCMS through 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Arbitrary Code Injection

Overview txtai is an All-in-one open-source AI framework for semantic search, LLM orchestration and language model workflows Affected versions of this package are vulnerable to Arbitrary Code Injection via the function parameter in the /reindex API endpoint when it is resolved through the Resolve...

CVE-2026-7057 Tenda F456 httpd setcfm buffer overflow

A flaw has been found in Tenda F456 1.0.0.5. The affected element is an unknown function of the file /goform/setcfm of the component httpd. This manipulation of the argument funcname/funcpara1 causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published a...

REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)

Summary A reflected XSS vulnerability has been identified in the REDAXO backend. The function parameter is concatenated into an API error message and rendered without HTML escaping. --- Details Root cause User input function is injected into an exception message, then rendered by rexview::error...

CVE-2025-45059

The D-Link DI-8300 wireless broadband router, specifically version 16.07.26A1 , is vulnerable to a buffer overflow in the tgfile_htm function. The flaw occurs via the fn parameter , where a failure to properly check input sizes allows an attacker to provide crafted input to trigger the overflow. ...

CVE-2026-26723

Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via the function parameter...

CVE-2026-26723: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via the function parameter...

CVE-2026-26723

Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via the function parameter...

CVE-2020-37142

10-Strike Network Inventory Explorer 8.54 contains a structured exception handler buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting SEH records. Attackers can craft a malicious payload targeting the 'Computer' parameter during the 'Add' function to trigg...

EUVD-2021-20477

Malware in sbrugna...

EUVD-2025-4498

Malicious code in bioql PyPI...

EUVD-2025-24012

Malicious code in bioql PyPI...

CVE-2025-57528

An issue was discovered in Tenda AC6 USAC6V1.0BRV15.03.05.16multiTD01 allowing attackers to cause a denial of service via the funcname, funcpara1, funcpara2 parameters to the formSetCfm function uri path: SetCfm...

CVE-2025-5865

A vulnerability was found in RT-Thread 5.1.0. It has been rated as critical. Affected by this issue is the function sysselect of the file rt-thread/components/lwp/lwpsyscall.c of the component Parameter Handler. The manipulation of the argument timeout leads to memory corruption. The vendor...

CVE-2025-45857

EDIMAX CV7428NS v1.20 was discovered to contain a remote code execution RCE vulnerability via the command parameter in the mp function...

Tenda i12 security vulnerabilities

The Tenda i12 is an enterprise commercial high power AP wireless access point. The Tenda i12 formSetCfm handles a buffer overflow vulnerability in the funcpara1 parameter, which can be exploited by a remote attacker to submit a special request that can crash the application and cause a denial of...

D-Link DI-8003 Router Heap Buffer Overflow DoS

The vulnerability of the tgfilehtm function in D-Link DI-800 router microprogramming software is related to the execution of operations outside the buffer during the processing of the fn parameter. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity...