CVE-2025-1360 Internet Web Solutions Sublime CRM HTTP POST Request inicio.php cross site scripting

A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the file /crm/inicio.php of the component HTTP POST Request Handler. The manipulation of the argument msgto leads to cross site scripting. It is...

CVE-2025-1360 Internet Web Solutions Sublime CRM HTTP POST Request inicio.php cross site scripting

A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the file /crm/inicio.php of the component HTTP POST Request Handler. The manipulation of the argument msgto leads to cross site scripting. It is...

CVE-2025-1360

Summary: CVE-2025-1360 affects Internet Web Solutions Sublime CRM up to version 20250207. The vulnerability exists in the HTTP POST Request Handler, specifically an unknown function in the file /crm/inicio.php, where manipulation of the msg_to parameter leads to cross-site scripting. It can be ex...

PT-2025-6893 · Internet Web Solutions · Sublime Crm

Name of the Vulnerable Software and Affected Versions: Internet Web Solutions Sublime CRM up to 20250207 Description: A problematic vulnerability was found in the HTTP POST Request Handler component of Internet Web Solutions Sublime CRM, affecting an unknown function of the file /crm/inicio.php...

SUSE CVE-2024-8925

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to...

The vulnerability in the form2Wan.cgi script of the D-Link DIR-816A router’s software allows a hacker to execute arbitrary code.

The vulnerability of the form2Wan.cgi script in the D-Link DIR-816A2 router software is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTTP POST request...

CVE-2024-56908

Perfex CRM versions before 3.2.1 are affected by CVE-2024-56908. An authenticated attacker can issue a crafted HTTP POST to the upload_sales_file endpoint and supply malicious input in the rel_id parameter, taking advantage of improper input validation to bypass restrictions and upload arbitrary ...

CVE-2024-56908

In Perfex Crm 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected uploadsalesfile endpoint. By providing malicious input in the relid parameter, combined with improper input validation, the attacker can bypass restrictions and upload arbitrary files to directorie...

CVE-2024-46430

Tenda W18E V16.01.0.81625 is vulnerable to Incorrect Access Control. Unauthorized password change via the web management portal allows an unauthenticated remote attacker to change the administrator password by sending a specially crafted HTTP POST request to the setLoginPassword function, bypassi...

The vulnerability in the formDMZ.cgi script of the D-Link DIR-816A router’s software allows a attacker to execute arbitrary code.

The vulnerability of the formDMZ.cgi script in the D-Link DIR-816A2 router’s microprogramming software is related to the incorrect use of standard permissions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially created HTTP POST request...

CVE-2024-46437

A sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.81625 web management portal allows an unauthenticated remote attacker to retrieve sensitive configuration information, including WiFi SSID, WiFi password, and base64-encoded administrator credentials, by sending a special...

CVE-2024-46437

The CVE-2024-46437 entry concerns the Tenda W18E web management portal (V16.01.0.8(1625)). A vulnerability in the getQuickCfgWifiAndLogin function allows an unauthenticated attacker to retrieve sensitive configuration data (WiFi SSID, WiFi password, and base64-encoded administrator credentials) v...

CVE-2024-46432

Summary (CVE-2024-46432) : Tenda W18E router (version 16.01.0.8(1625)) is affected by an Incorrect Access Control vulnerability in the SetQuickcfgWifiAndDlogin/setQuickCfgWifiAndLogin function, allowing an attacker to issue a crafted HTTP POST and make unauthorized changes to WiFi configuration a...

CVE-2025-1103

A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function setwifiblacklists of the file /goform/setwifiblacklists of the component HTTP POST Request Handler. The manipulation of the argument macList leads to null pointer dereferenc...

CVE-2025-1103 D-Link DIR-823X HTTP POST Request set_wifi_blacklists null pointer dereference

A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function setwifiblacklists of the file /goform/setwifiblacklists of the component HTTP POST Request Handler. The manipulation of the argument macList leads to null pointer dereferenc...

CVE-2025-1103 D-Link DIR-823X HTTP POST Request set_wifi_blacklists null pointer dereference

A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function setwifiblacklists of the file /goform/setwifiblacklists of the component HTTP POST Request Handler. The manipulation of the argument macList leads to null pointer dereferenc...

CVE-2025-1103

CVE-2025-1103 affects D-Link DIR-823X (versions 240126–240802). The vulnerability resides in the HTTP POST Request Handler: set_wifi_blacklists (/goform/set_wifi_blacklists). Manipulating the macList argument triggers a null pointer dereference, with remote exploitability and public disclosure. P...

PT-2025-5980 · D Link · Dir-823

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823X versions 240126 through 240802 Description: A problematic issue was found in the HTTP POST Request Handler component, specifically affecting the set wifi blacklists function of the /goform/set wifi blacklists file. The...

CVE-2019-5071

An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi Route AC9V1.0 Firmware V15.03.05.16multiTRU. A specially crafted HTTP POST request can cause a command injection in the DNS1 post...

CVE-2019-5072

An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi Route AC9V1.0 Firmware V15.03.05.16multiTRU. A specially crafted HTTP POST request can cause a command injection in the DNS2 post...