CVE-2020-36905: Inclusion of Functionality from Untrusted Control Sphere

FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attackers can exploit the 'url' GET parameter to inject malicious JavaScript and potentially hijack user sessions or...

AdGuard Home: undisclosed vulnerability (ZAI-2026-9LKYAW)

Not disclosed. Details are not yet publicly disclosed...

AdGuard Home: undisclosed vulnerability (ZAI-2026-0Q1F8F)

Not disclosed. Details are not yet publicly disclosed...

AdGuard Home: undisclosed vulnerability (ZAI-2026-E6LMXE)

Not disclosed. Details are not yet publicly disclosed...

AdGuard Home: undisclosed vulnerability (ZAI-2026-QGGF0M)

Not disclosed. Details are not yet publicly disclosed...

AdGuard Home: undisclosed vulnerability (ZAI-2026-EKT6Z7)

Not disclosed. Details are not yet publicly disclosed...

EUVD-2025-205864

Ksenia Security Lares 4.0 Home Automation version 1.6 contains a default credentials vulnerability that allows unauthorized attackers to gain administrative access. Attackers can exploit the weak default administrative credentials to obtain full control of the home automation system...

EUVD-2025-205861

Ksenia Security Lares 4.0 Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without...

CVE-2025-15374: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in EyouCMS up to 1.7.7. The affected element is an unknown function of the file application/home/model/Ask.php of the component Ask Module. Performing a manipulation of the argument content results in cross site scripting. The attack can be initiated remotely. The...

CVE-2025-15114

Ksenia Security lares legacy model Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system...

CVE-2025-15111

Ksenia Security lares legacy model version 1.6 contains a default credentials vulnerability that allows unauthorized attackers to gain administrative access. Attackers can exploit the weak default administrative credentials to obtain full control of the home automation system...

CVE-2025-15111

Ksenia Security lares legacy model version 1.6 contains a default credentials vulnerability that allows unauthorized attackers to gain administrative access. Attackers can exploit the weak default administrative credentials to obtain full control of the home automation system...

CVE-2025-15114 Ksenia Security lares Home Automation 1.6 PIN Exposure Vulnerability

Ksenia Security lares legacy model Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system...

CVE-2025-15114

CVE-2025-15114 affects Ksenia Security Lares 4.0 Home Automation (v1.6). The root cause is exposure of the alarm PIN in the basisInfo XML response after authentication, allowing an unauthenticated or post-auth access to retrieve the PIN from server responses and bypass security to disable the ala...

CVE-2025-15114 Ksenia Security lares Home Automation 1.6 PIN Exposure Vulnerability

Ksenia Security lares legacy model Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system...

CVE-2025-15112 Ksenia Security lares Home Automation 1.6 URL Redirection Vulnerability

Ksenia Security lares legacy model version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 'redirectPage' GET parameter. Attackers can craft malicious links that redirect authenticated users to arbitrary websites when clicking on a...

CVE-2025-15113 Ksenia Security lares Home Automation 1.6 Remote Code Execution via MPFS Upload

Ksenia Security lares legacy model Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload MPFS File System binary images. Attackers can exploit this vulnerability to overwrite flash program memory and potentially execute arbitrary...

CVE-2025-15113 Ksenia Security lares Home Automation 1.6 Remote Code Execution via MPFS Upload

Ksenia Security lares legacy model Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload MPFS File System binary images. Attackers can exploit this vulnerability to overwrite flash program memory and potentially execute arbitrary...

CVE-2025-15113

Ksenia Security Lares 4.0 Home Automation (version 1.6) is affected by CVE-2025-15113 due to an unprotected endpoint that lets authenticated attackers upload MPFS File System binary images. This can overwrite flash memory and potentially execute arbitrary code on the web server. Exploitation deta...

CVE-2025-15111 Ksenia Security lares Home Automation 1.6 Default Credentials Vulnerability

Ksenia Security lares legacy model version 1.6 contains a default credentials vulnerability that allows unauthorized attackers to gain administrative access. Attackers can exploit the weak default administrative credentials to obtain full control of the home automation system...