NetWin Netwin SurgeFTP 安全漏洞

NetWin Netwin SurgeFTP is a multi-platform FTP server software from NetWin New Zealand. A security vulnerability exists in NetWin Netwin SurgeFTP version 23c8 and prior versions, which stems from an improper handling of POST requests and could lead to remote command execution...

Directory Traversal

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Directory Traversal via the addcrypted endpoint when processing the package parameter. An attacker can achieve arbitrary file write and execute malicious co...

The vulnerability of the formSetWAN_Wizard51() function (/goform/formSetWAN_Wizard51) in the D-Link DIR-619L router microprogramming software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formAdvanceSetup function /goform/formAdvanceSetup of the D-Link DIR-619L router’s microprogramming software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

CVE-2013-10035

A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPageAjax.php, and casesSchedulerGetPlugins.php, by supplying...

The vulnerability of the formSetIptv() function in the microprogramming software for the Tenda AX1803 allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the formSetIptv function in the microprogramming software for the Tenda AX1803 router is related to buffer overflows in the stack during the processing of the adv.iptv.stballvlans parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a...

MB CONNECT LINE mbNET.mini Resource Management Error Vulnerability

The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. MB CONNECT LINE mbNET.mini suffers from a resource management error vulnerability that originates from exhausting critic...

CVE-2025-41676

A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession...

CVE-2025-41673

A high privileged remote attacker can execute arbitrary system commands via POST requests in the sendsms action due to improper neutralization of special elements used in an OS command...

CVE-2025-41677

A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession...

CVE-2025-41681

A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content...

CVE-2025-41681

A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content...

CVE-2025-41677

A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession...

CVE-2025-41677

A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession...

CVE-2025-41674

A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command...

CVE-2025-41674

A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command...

CVE-2025-41678

A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement...

CVE-2025-41676

A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession...

CVE-2025-41673

A high privileged remote attacker can execute arbitrary system commands via POST requests in the sendsms action due to improper neutralization of special elements used in an OS command...

CVE-2025-41681 Persistent Cross-Site Scripting via POST Requests Due to Improper Neutralization of Input

A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content...

CVE-2025-41678 SQL Injection via POST Requests Allowing Configuration Database Manipulation

A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement...