CVE-2025-0125

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the...

CVE-2024-41788

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager All versions. The web interface of affected devices does not sanitize the input parameters in specific GET requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges...

The vulnerability in the web interface for managing Tenda FH1202 micro-program software routers allows a hacker to escalate their privileges.

The vulnerability of the web interface for managing Tenda FH1202 micro-programming software routers is related to deficiencies in access control when processing the /goform/qossetting endpoint. Exploiting this vulnerability allows a malicious actor to enhance their privileges by sending specially...

CVE-2025-25213

The CVE-2025-25213 issue affects Inaba Denki Sangyo Co., Ltd. Wi‑Fi AP UNIT AC-WPS-11ac series (affected versions include v2.0.03P and prior). Root cause: improper restriction of rendered UI layers or frames, enabling unintended operations when a logged‑in user views/clicks on content hosted on a...

CVE-2025-27079 Arbitrary File Creation vulnerability allows for Authenticated Remote Code Execution in CLI Interface

A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to perform remote code execution RCE. Successful exploitation could allow an attacker to execute arbitrary operating system commands on the...

CVE-2024-41795

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager All versions. The web interface of affected devices is vulnerable to Cross-Site Request Forgery CSRF attacks. This could allow an unauthenticated attacker to change arbitrary device settings by tricking a legitimate device...

CVE-2024-41790

CVE-2024-41790 affects Siemens SENTRON 7KT PAC1260 Data Manager (all versions). The issue is an OS command injection stemming from improper handling of the region parameter in specific POST requests to the device’s web interface, allowing an authenticated remote attacker to execute arbitrary comm...

CVE-2024-41788

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager All versions. The web interface of affected devices does not sanitize the input parameters in specific GET requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges...

The vulnerability in the web interface of the Cisco Prime Infrastructure monitoring and management system, as well as the Cisco Evolved Programmable Network Manager (EPNM) software for managing network services, allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the web interface for managing Cisco Prime Infrastructure network equipment and the Cisco Evolved Programmable Network Manager EPNM software lies in the insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to perform...

The vulnerability of the web interface of the “Central Archive of Medical Images” information system, which stems from the lack of protective measures for the website structure, allows attackers to gain unauthorized access to the protected information.

The vulnerability of the web interface of the “Central Archive of Medical Images” information system is related to the lack of protective measures for the website structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the protected...

The vulnerability in the web interface for managing micro-program software on Cisco Expressway allows a hacker to redirect users to any arbitrary URL address.

The vulnerability of the web interface for managing microprogramming software in Cisco Expressway is related to the use of open redirection. Exploiting this vulnerability allows a malicious actor to redirect users to any arbitrary URL address...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload arbitrary files, increase their privileges, and execute arbitrary commands.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform relates to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to load arbitrary files, increase their privileges, and execute arbitrary commands...

DEBIAN-CVE-2024-42325

Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc...

CVE-2024-54806

Netgear WNR854T 1.5.2 North America is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system commands via the web interface...

The vulnerability of the ADI web interface of the Verve Asset Manager software allows a perpetrator to execute arbitrary commands within the context of the Agentless Device Inventory.

The vulnerability of the ADI web interface of the Verve Asset Manager software solution is related to the failure to take measures to neutralize certain special elements. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary commands within the...

The vulnerability of the web interface of Moxa network device software for models EDF-G1002-BP, EDR-810, EDR-8010, EDR-G9004, EDR-G9010, NAT-102, TN-4900, and OnCell G4302-LTE4 allows a perpetrator to execute arbitrary commands through NTP settings, thereby gaining full control over the device.

The vulnerability of the web interface of Moxa network devices of the EDF-G1002-BP, EDR-810, EDR-8010, EDR-G9004, EDR-G9010, NAT-102, TN-4900, and OnCell G4302-LTE4 series is related to the lack of measures to neutralize specific components. Exploiting this vulnerability allows a malicious actor ...

The vulnerability of the GUI component of the FortiSandbox threat detection and mitigation system allows a perpetrator to execute arbitrary commands.

The vulnerability of the GUI component of the FortiSandbox threat detection and mitigation system is related to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability in the web interface of Netgear WNR854T router software allows a hacker to execute arbitrary commands and gain full control over the device.

The vulnerability of the web interface of Netgear WNR854T router software lies in the lack of measures to neutralize special elements used in the operating system’s commands when processing the wanhostname parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

CVE-2025-27405

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of tha...

The vulnerability of the web interface of the cross-platform FTP server CrushFTP allows a hacker to gain unauthorized access to the software.

The vulnerability of the cross-platform FTP server CrushFTP lies in the deficiencies of its authentication process. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to the software by sending a specially crafted HTTP request...