CVE-2026-1468: Cross-Site Request Forgery (CSRF)

QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges. This software does not implement any protection against this type of attack. Al...

CVE-2026-28781

Craft is a content management system CMS. Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds or authorId parameter into the POST request, which the backend...

CVE-2025-70231

D-Link DIR-513 version 1.10 contains a critical-level vulnerability. When processing POST requests related to verification codes in /goform/formLogin, it enters /goform/getAuthCode but fails to filter the value of the FILECODE parameter, resulting in a path traversal vulnerability...

CVE-2025-70218

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via POST to the goform/formAdvFirewall component...

PT-2026-23471

Name of the Vulnerable Software and Affected Versions D-Link DIR-513 version 1.10 Description The D-Link DIR-513 version 1.10 device has a flaw where it doesn't properly check the FILECODE parameter when handling POST requests to the /goform/formLogin endpoint. This allows for a path traversal...

CVE-2025-70231

D-Link DIR-513 version 1.10 contains a critical-level vulnerability. When processing POST requests related to verification codes in /goform/formLogin, it enters /goform/getAuthCode but fails to filter the value of the FILECODE parameter, resulting in a path traversal vulnerability...

CVE-2019-25499

Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the jobid parameter. Attackers can send POST requests to getjobapplicationsajax.php with malicious jobid values to bypass authentication,...

CVE-2019-25501 Simple Job Script SQL Injection via delete_application_ajax.php

Simple Job Script contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting malicious SQL code through the appid parameter. Attackers can send POST requests to deleteapplicationajax.php with crafted payloads to extract sensitive data, bypass...

PT-2026-23008

Name of the Vulnerable Software and Affected Versions D-Link DIR-513 version 1.10 Description A stack buffer overflow issue exists in the D-Link DIR-513. The issue is triggered by sending a POST request to the goform/formAdvFirewall component. The vulnerability allows for potential compromise of...

CVE-2025-70218

A stack buffer overflow vulnerability exists in the D-Link DIR-513 (v1.10) wireless router. The issue originates from the goform/formAdvFirewall component, which fails to properly validate the length and size of input data received via a POST request. An attacker exploiting this vulnerability cou...

CVE-2025-70218

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via POST to the goform/formAdvFirewall component...

The vulnerability of the sub_432580 function (/goform/fastetting_wifi_set) in the microprogramming software for Tenda TX9 Pro allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sub432580 /goform/fastsettingwifiset function in the microprogramming software for Tenda TX9 Pro relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the sub_42D03C (/goform/SetStaticRouteCfg) function in the Tenda TX9 Pro router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sub42D03C /goform/SetStaticRouteCfg function in the Tenda TX9 Pro router software is related to the operation of writing data outside the buffer in memory when processing the deviceList parameter. Exploiting this vulnerability allows an attacker to compromise the...

The vulnerability of the sub_4223E0 function (/goform/setMacFilterCfg) in the Tenda TX9 Pro router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sub4223E0 function /goform/setMacFilterCfg in the Tenda TX9 Pro router software is related to the operation of writing data beyond the buffer in memory when processing the deviceList parameter. Exploiting this vulnerability allows an attacker to compromise the...

PT-2026-22956

Name of the Vulnerable Software and Affected Versions Simple Job Script affected versions not specified Description The software contains an SQL injection issue that allows manipulation of database queries through malicious SQL code. Attackers can exploit this by injecting code via the app id...

PT-2026-22950

Name of the Vulnerable Software and Affected Versions Craft versions prior to 4.17.0-beta.1 Craft versions prior to 5.9.0-beta.1 Description The entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds or authorI...

CVE-2025-50198

CVE-2025-50198 affects Chamilo before version 1.11.30. The vulnerability is a deserialization of untrusted data in /plugin/vchamilo/views/import.php triggered via POST parameters (configuration_file, course_path, home_path). The issue is addressed in Chamilo 1.11.30. According to the provided met...

CVE-2025-50189

Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST resourcedocumentSQLINJECTIONHERE and POST login parameters found in /main/coursecopy/copycoursesessionselected.php, which allows an attack...

EUVD-2025-208160

Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script. This issue has been patched in version 1.11.30...

CVE-2025-50191

Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script. This issue has been patched in version 1.11.30...