CVE-2025-3966: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/home?userId=1&homeSelectType=read of the component Browsing History Handler. The manipulation leads to information disclosure. The attack may...

D-Link DIR-816 A2 Command Injection Vulnerability

The D-Link DIR-816 A2 is a home and small office SOHO wireless router from D-Link. A command injection vulnerability exists in the D-Link DIR-816 A2. The vulnerability originates in the /goform/delRouting path. No detailed vulnerability details are provided at this time...

User Profiles: the Achilles' Heel of Web Browsers

Web browsers provide the security foundation for our online experiences. Significant research has been done into the security of browsers themselves, but relatively little investigation has been done into how they interact with the operating system or the file system. In this work, we provide the...

TP-Link Tapo H200 Open Information Disclosure

The vulnerability of TP-Link Tapo H200 smart home control software relates to the storage of information in an open manner. Exploiting this vulnerability could allow a intruder to obtain Wi-Fi credentials...

D-Link DIR-816 A2 安全漏洞

The D-Link DIR-816 A2 is a home and small office SOHO wireless router from D-Link. A command injection vulnerability exists in the D-Link DIR-816 A2. The vulnerability originates in the /goform/delRouting path. No detailed vulnerability details are provided at this time...

CVE-2025-28232

Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication...

CVE-2025-31654

An attacker can get information about the groups of the smart home devices for arbitrary users i.e., "rooms"...

CVE-2025-26930

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in alleythemes Home Services home-services allows DOM-Based XSS.This issue affects Home Services: from n/a through = 1.2.6...

CVE-2025-31654

An attacker can get information about the groups of the smart home devices for arbitrary users i.e., "rooms"...

CVE-2025-31654

An attacker can get information about the groups of the smart home devices for arbitrary users i.e., "rooms"...

CVE-2025-26930

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in alleythemes Home Services home-services allows DOM-Based XSS.This issue affects Home Services: from n/a through = 1.2.6...

CVE-2025-26930

CVE-2025-26930 describes a DOM-based XSS in the alleythemes Home Services WordPress plugin, affecting versions

CVE-2025-26930 WordPress Home Services plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in alleythemes Home Services home-services allows DOM-Based XSS.This issue affects Home Services: from n/a through = 1.2.6...

CVE-2025-31654 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can get information about the groups of the smart home devices for arbitrary users i.e., "rooms"...

CVE-2025-31654 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can get information about the groups of the smart home devices for arbitrary users i.e., "rooms"...

CVE-2025-31654

CVE-2025-31654 concerns Growatt Cloud Applications where an attacker can obtain information about the groups of smart home devices for arbitrary users (i.e., the users’ “rooms”). The CVE appears across multiple sources (NVD, Red Hat, CVE List, CVSS metrics) and is associated with the Growatt clou...

CVE-2021-27289

A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix Zigbee Gateway Module = v1.0.3, Door Sensor = v1.0.7, Motion Sensor = v1.0.12, where the Zigbee anti-replay mechanism - based on the frame counter field - is improperly implemented. As a result, an attack...

PT-2025-16370

Name of the Vulnerable Software and Affected Versions Ksix Zigbee smart home kit versions v1.0.3 through v1.0.12 Description A replay attack issue was discovered in the Zigbee smart home kit, where the anti-replay mechanism based on the frame counter field is improperly implemented. This allows a...

Growatt Cloud Applications 安全漏洞

Growatt Cloud Applications is a monitoring platform from Growatt, a Chinese company. A security vulnerability exists in Growatt Cloud Applications version 3.6.0 and earlier, which stems from an attacker's ability to gain access to any user's smart home device group information...

WordPress plugin Home Services 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...