CVE-2024-7476

The CVE-2024-7476 issue is a broken access control in lunary-ai/lunary versions 1.2.7 through 1.4.2. The root cause is improper access control on the /v1/templates/{id}/versions endpoint, which allows an authenticated attacker to modify any user’s templates by sending a crafted HTTP POST request....

CVE-2024-7476: Authorization Bypass Through User-Controlled Key

A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/id/versions endpoint. This issue is resolved in version 1.4....

PT-2025-12185 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions 1.2.7 through 1.4.2 Description: A broken access control issue exists, allowing an authenticated attacker to modify any user's templates. This is achieved by sending a crafted HTTP POST request to the...

CVE-2025-30236: External Control of Assumed-Immutable Web Parameter

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code skipping a password check if an HTTP POST request contains a SESSION parameter...

PT-2025-11666

Name of the Vulnerable Software and Affected Versions Shearwater SecurEnvoy SecurAccess versions prior to 9.4.515 Description The issue allows authentication through only a six-digit TOTP code, skipping a password check, if an HTTP POST request contains a SESSION parameter. This is related to...

PT-2025-11176

Name of the Vulnerable Software and Affected Versions: Italtel S.p.A. i-MCS NFV version 12.1.0-20211215 Description: The issue is a cross-site scripting XSS vulnerability that allows unauthenticated remote attackers to inject arbitrary web script or HTML into HTTP/POST parameters. This can be...

CVE-2024-28803: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Italtel S.p.A. i-MCS NFV v.12.1.0-20211215 allows unauthenticated remote attackers to inject arbitrary web script or HTML into HTTP/POST parameter...

D-Link DAP-1562 Null Pointer Dereference Vulnerability

The D-Link DAP-1562 is a wireless bridge from China's AUO D-Link. The D-Link DAP-1562 suffers from a null pointer dereference vulnerability, which originates from a null pointer dereference to parameter a1 in the HTTP POST Request Handler's function pureauthcheck, for which no detailed...

CVE-2021-37787

The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnerability via a HTTP POST request to the TinyMCE module...

CVE-2021-37787: Improper Neutralization of Special Elements used in an SQL Command

The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnerability via a HTTP POST request to the TinyMCE module...

CVE-2024-50704

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially crafted HTTP POST request...

PT-2025-12719

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X versions 240126/240802 Description A critical issue has been found in the HTTP POST Request Handler component, specifically affecting the function sub 41710C of the file /goform/diag nslookup. The manipulation of the target add...

CVE-2024-50704

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially crafted HTTP POST request...

CVE-2024-50704

A critical unauthenticated remote code execution vulnerability exists in Uniguest Tripleplay versions prior to 24.2.1 . The flaw allows remote attackers to execute arbitrary code by sending a specially crafted HTTP POST request . This vulnerability is categorized under CWE-94 (Improper Control of...

CVE-2024-50704

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially crafted HTTP POST request...

CVE-2024-50704: Improper Control of Generation of Code

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially crafted HTTP POST request...

CVE-2024-50704

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially crafted HTTP POST request...

PT-2025-9673

Name of the Vulnerable Software and Affected Versions Uniguest Tripleplay versions prior to 24.2.1 Description The issue allows unauthenticated remote code execution via a specially crafted HTTP POST request. Recommendations For versions prior to 24.2.1, update to version 24.2.1 or later to resol...

CVE-2025-1877 D-Link DAP-1562 HTTP POST Request pure_auth_check null pointer dereference

A vulnerability, which was classified as critical, was found in D-Link DAP-1562 1.10. This affects the function pureauthcheck of the component HTTP POST Request Handler. The manipulation of the argument a1 leads to null pointer dereference. It is possible to initiate the attack remotely. The...

CVE-2025-1877 D-Link DAP-1562 HTTP POST Request pure_auth_check null pointer dereference

A vulnerability, which was classified as critical, was found in D-Link DAP-1562 1.10. This affects the function pureauthcheck of the component HTTP POST Request Handler. The manipulation of the argument a1 leads to null pointer dereference. It is possible to initiate the attack remotely. The...