7801 matches found
CVE-2025-67399
The AIRTH SMART HOME AQI MONITOR (Bootloader v.1.005) is vulnerable to unauthorized information disclosure. A physically proximate attacker can access the BK7231N controller (Wi-Fi and BLE module) via an exposed UART port . By identifying the SoC and using a USB-to-TTL converter with vendor tools...
CVE-2025-67399
An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the UART port of the BK7231N controller Wi-Fi and BLE module on the device is open to access...
CVE-2025-67399: Exposure of Sensitive Information to an Unauthorized Actor
An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the UART port of the BK7231N controller Wi-Fi and BLE module on the device is open to access...
PT-2026-2908
Name of the Vulnerable Software and Affected Versions AIRTH SMART HOME AQI MONITOR Bootloader version 1.005 Description An issue allows a physically proximate attacker to obtain sensitive information via the UART port of the BK7231N controller Wi-Fi and BLE module on the device. The UART port is...
CVE-2025-40976
Stored Cross-Site Scripting XSS vulnerability in WorkDo's TicketGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/ticketgo-saas/home’, using the ‘description’ parameter...
The vulnerability in the cmdOk.xml script of the “Smart Home” system creation platform Lares 4.0 allows a hacker to redirect a user to an arbitrary URL address.
The vulnerability in the cmdOk.xml script of the “Smart Home” system Lares 4.0 involves redirecting the URL to an unreliable website when processing the redirectPage parameter. Exploiting this vulnerability allows a malicious actor to redirect users to any given URL address...
CVE-2025-65552
D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel. The system does not implement rolling codes, message authentication, or anti-replay protection, allowing an attacker within RF range to record valid alarm/control frames an...
CVE-2025-40976
Stored Cross-Site Scripting XSS vulnerability in WorkDo's TicketGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/ticketgo-saas/home’, using the ‘description’ parameter...
CVE-2025-40976
The CVE-2025-40976 entry concerns WorkDo’s TicketGo SaaS with a stored XSS flaw arising from insufficient input validation on the description field when a POST is sent to /ticketgo-saas/home. Affected component: TicketGo (WorkDo). Root cause: lack of proper validation of user-supplied data in the...
CVE-2025-40976 Multiple vulnerabilities in WorkDo products
Stored Cross-Site Scripting XSS vulnerability in WorkDo's TicketGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/ticketgo-saas/home’, using the ‘description’ parameter...
CVE-2025-40976: Improper Neutralization of Input During Web Page Generation
Stored Cross-Site Scripting XSS vulnerability in WorkDo's TicketGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/ticketgo-saas/home’, using the ‘description’ parameter...
CVE-2025-65553
D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range can transmit continuous interference to block sensor transmissions, resulting in missed alarms and loss of security monitoring. The device lacks jamming...
PT-2026-1799
Name of the Vulnerable Software and Affected Versions WorkDo's TicketGo affected versions not specified Description A stored Cross-Site Scripting XSS issue exists due to insufficient validation of user-supplied data. The issue involves sending a POST request to the ''/ticketgo-saas/home'' API...
CVE-2025-65552: Authentication Bypass by Capture-replay
D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel. The system does not implement rolling codes, message authentication, or anti-replay protection, allowing an attacker within RF range to record valid alarm/control frames an...
CVE-2025-65553
The D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is vulnerable to RF jamming on the 433 MHz alarm sensor channel . Because the device lacks jamming detection or mitigations, an attacker within RF range can transmit continuous interference to block sensor transmissions. This results in a denial-o...
PT-2026-2268
Name of the Vulnerable Software and Affected Versions D3D Wi-Fi Home Security System ZX-G12 version 2.1.1 Description The D3D Wi-Fi Home Security System ZX-G12 version 2.1.1 is susceptible to RF replay attacks on the 433 MHz sensor communication channel. The system lacks essential security measur...
CVE-2025-65553: Authentication Bypass by Capture-replay
D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range can transmit continuous interference to block sensor transmissions, resulting in missed alarms and loss of security monitoring. The device lacks jamming...
Stored XSS in Home Feed via Post Content Lead to Account Takeover
Description A Stored Cross-Site Scripting XSS vulnerability was identified in the social feature of the application. The backend fails to sanitize user-provided content in the post creation endpoint. This allows an attacker to inject and store malicious JavaScript, which is then executed in the...
PT-2026-31885
Name of the Vulnerable Software and Affected Versions parisneo/lollms versions prior to 2.2.0 Description A Stored Cross-Site Scripting XSS vulnerability exists in the social feature of parisneo/lollms. The vulnerability is located in the create post function within backend/routers/social/ init...