CVE-2009-20006: Unrestricted Upload of File with Dangerous Type

osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility admin/filemanager.php. The interface allows file uploads and edits without sufficient input validation or access control. An unauthenticated attacker can craft a POST request to...

Fastwel PLC Command Injection Privilege Escalation

The vulnerability of the built-in software of the PLC Fastwel is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary operating system commands and elevate their...

CVE-2025-10411

A vulnerability was detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing of the file /stc-log-keeper/checkprofile.php of the component POST Request Handler. The manipulation of the argument profileid results in cross site...

CVE-2025-10386 Yida ECMS Consulting Enterprise Management System POST Request login.do cross site scripting

A vulnerability was found in Yida ECMS Consulting Enterprise Management System 1.0. This affects an unknown part of the file /login.do of the component POST Request Handler. The manipulation of the argument requestUrl results in cross site scripting. It is possible to launch the attack remotely...

CVE-2025-10386

CVE-2025-10386 affects Yida ECMS Consulting Enterprise Management System 1.0. The vulnerability is in the POST Request Handler for the file path /login.do, where manipulating the argument requestUrl enables cross-site scripting. It can be triggered remotely, and public exploits exist. Reports not...

CVE-2025-10386 Yida ECMS Consulting Enterprise Management System POST Request login.do cross site scripting

A vulnerability was found in Yida ECMS Consulting Enterprise Management System 1.0. This affects an unknown part of the file /login.do of the component POST Request Handler. The manipulation of the argument requestUrl results in cross site scripting. It is possible to launch the attack remotely...

CVE-2025-10411: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing of the file /stc-log-keeper/checkprofile.php of the component POST Request Handler. The manipulation of the argument profileid results in cross site...

CVE-2025-10386: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Yida ECMS Consulting Enterprise Management System 1.0. This affects an unknown part of the file /login.do of the component POST Request Handler. The manipulation of the argument requestUrl results in cross site scripting. It is possible to launch the attack remotely...

PT-2025-37431

Name of the Vulnerable Software and Affected Versions itsourcecode E-Logbook version 1.0 Description A cross-site scripting issue exists due to the manipulation of the profile id argument in the POST Request Handler component. The vulnerability affects the processing of the file...

CVE-2025-40694

Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fromdate' and 'todate' parameters via POST at the endpoint '/ofrs/admin/bwdates-report-result.php'. This vulnerability...

CVE-2025-40694

Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fromdate' and 'todate' parameters via POST at the endpoint '/ofrs/admin/bwdates-report-result.php'. This vulnerability...

PT-2025-53572

Уязвимость функции sub 401778 микропрограммного обеспечения маршрутизаторов Wavlink NU516U1 связана с непринятием мер по очистке данных на управляющем уровне при обработке аргумента dmz flagt. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольные команд...

PT-2025-53569

Уязвимость функции sub 401B30 микропрограммного обеспечения маршрутизаторов Wavlink NU516U1 связана с непринятием мер по очистке данных на управляющем уровне при обработке аргумента remoteManagementEnabled. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить...

PT-2025-53575

Уязвимость функции sub 4016F0 микропрограммного обеспечения маршрутизаторов Wavlink NU516U1 связана с непринятием мер по очистке данных на управляющем уровне при обработке аргумента del flag. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольные команды...

PT-2025-53571

Уязвимость компонента DeleteMac Page функции sub 402D1C микропрограммного обеспечения маршрутизаторов Wavlink NU516U1 связана с непринятием мер по очистке данных на управляющем уровне при обработке аргумента delete list. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно,...

PT-2025-53570

Уязвимость компонента Delete Mac list Page функции sub 4030C0 микропрограммного обеспечения маршрутизаторов Wavlink NU516U1 связана с непринятием мер по очистке данных на управляющем уровне при обработке аргумента delete list. Эксплуатация уязвимости может позволить нарушителю, действующему...

PT-2025-82: Insecure OS сommand execution mechanism in Fastwel PLC web server

The vulnerability was identified in Fastwel programmable controllers, versions 3.4.5.0 CPM810-03, 3.4.9.1 СPM723-01. The discovered vulnerability allows a remote attacker to execute arbitrary operating system commands and escalate their privileges to superuser level by sending a POST request via ...

TOTOLINK A702R Router DoS

The vulnerability of the sub4162DC function /boafrm/formFilter of the TOTOLINK A702R router’s software lies in the issue of the operation going beyond the buffer in memory when processing the ip6addr parameter. Exploiting this vulnerability allows a malicious actor to cause service failure by...

D-Link DIR-825 Router Code Execution

The vulnerability of the getping6appstat function in D-Link DIR-825 router microprogramming software is related to the execution of operations outside the buffer in memory when processing the ping6ipaddr parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code b...

Remote Code Execution (RCE)

flowise is vulnerable to Remote Code Execution RCE. The vulnerability is due to unsafe use of a dynamic Function constructor due to user-controlled input being executed, allowing attackers to run arbitrary JavaScript via a crafted POST request...